openapi: '3.1.2'
info:
  title: Kibana APIs
  description: "The Kibana REST APIs enable you to manage resources such as connectors, data views, and saved objects.\nThe API calls are stateless.\nEach request that you make happens in isolation from other calls and must include all of the necessary information for Kibana to fulfill the\nrequest.\nAPI requests return JSON output, which is a format that is machine-readable and works well for automation.\n\nTo interact with Kibana APIs, use the following operations:\n\n- GET: Fetches the information.\n- PATCH: Applies partial modifications to the existing information.\n- POST: Adds new information.\n- PUT: Updates the existing information.\n- DELETE: Removes the information.\n\nYou can prepend any Kibana API endpoint with `kbn:` and run the request in **Dev Tools → Console**.\nFor example:\n\n```\nGET kbn:/api/data_views\n```\n\nFor more information about the console, refer to [Run API requests](https://www.elastic.co/docs/explore-analyze/query-filter/tools/console).\n\nNOTE: Access to internal Kibana API endpoints will be restricted in Kibana version 9.0. Please move any integrations to publicly documented APIs.\n\n## Documentation source and versions\n\nThis documentation is derived from the `main` branch of the [kibana](https://github.com/elastic/kibana) repository.\nIt is provided under license [Attribution-NonCommercial-NoDerivatives 4.0 International](https://creativecommons.org/licenses/by-nc-nd/4.0/).\n\nThis documentation contains work-in-progress information for future Elastic Stack releases.\n"
  contact:
    name: Kibana Team
  version: ''
  x-doc-license:
    name: Attribution-NonCommercial-NoDerivatives 4.0 International
    url: https://creativecommons.org/licenses/by-nc-nd/4.0/
  x-feedbackLink:
    label: Feedback
    url: https://github.com/elastic/docs-content/issues/new?assignees=&labels=feedback%2Ccommunity&projects=&template=api-feedback.yaml&title=%5BFeedback%5D%3A+
servers:
  - url: 'https://{kibana_url}'
    variables:
      kibana_url:
        default: localhost:5601
paths:
  /api/actions/connector_types:
    get:
      tags:
        - connectors
      summary: Get connector types
      description: You do not need any Kibana feature privileges to run this API.
      operationId: get-actions-connector-types
      parameters:
        - name: feature_id
          in: query
          description: A filter to limit the retrieved connector types to those that support a specific feature (such as alerting or cases).
          schema:
            maxLength: 100
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_type_response'
              examples:
                getConnectorTypesServerlessResponse:
                  $ref: '#/components/examples/get_connector_types_generativeai_response'
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connector/_oauth_callback:
    get:
      tags:
        - connectors
      summary: Handle OAuth callback
      description: 'Handles the OAuth 2.0 authorization code callback from external providers. Exchanges the authorization code for access and refresh tokens.<br/><br/>[Required authorization] Route required privileges: actions:oauth.'
      operationId: get-actions-connector-oauth-callback
      parameters:
        - name: code
          in: query
          description: The authorization code returned by the OAuth provider.
          schema:
            type: string
        - name: state
          in: query
          description: The state parameter for CSRF protection.
          schema:
            type: string
        - name: error
          in: query
          description: Error code if the authorization failed.
          schema:
            type: string
        - name: error_description
          in: query
          description: Human-readable error description.
          schema:
            type: string
        - name: session_state
          in: query
          description: 'Session state from the OAuth provider (e.g., Microsoft).'
          schema:
            type: string
      responses:
        '200':
          description: Returns an HTML callback page.
        '302':
          description: Redirects to the return URL with authorization result query parameters.
        '401':
          description: User is not authenticated.
      x-state: Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connector/_oauth_callback_script:
    get:
      summary: ''
      description: Returns the OAuth callback script
      operationId: get-actions-connector-oauth-callback-script
      responses:
        '200':
          description: Returns the OAuth callback script
      x-state: Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/actions/connector/{connectorId}/oauth/start':
    get:
      tags:
        - connectors
      summary: Start OAuth authorization (redirects to the identity provider)
      description: '[Required authorization] Route required privileges: actions:oauth.'
      operationId: get-actions-connector-connectorid-oauth-start
      parameters:
        - name: connectorId
          in: path
          description: An identifier for the connector.
          required: true
          schema:
            maxLength: 36
            type: string
      responses:
        '302':
          description: Redirects to the identity provider to begin OAuth authorization.
        '400':
          description: 'Invalid request, such as a disallowed returnUrl.'
        '401':
          description: User is not authenticated.
        '404':
          description: Connector not found.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/actions/connector/{id}':
    delete:
      tags:
        - connectors
      summary: Delete a connector
      description: 'WARNING: When you delete a connector, it cannot be recovered.'
      operationId: delete-actions-connector-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: An identifier for the connector.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - connectors
      summary: Get connector information
      operationId: get-actions-connector-id
      parameters:
        - name: id
          in: path
          description: An identifier for the connector.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                getConnectorResponse:
                  $ref: '#/components/examples/get_connector_response'
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - connectors
      summary: Create a connector
      operationId: post-actions-connector-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: An identifier for the connector.
          required: true
          schema:
            maxLength: 36
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_connector'
            examples:
              createEmailConnectorRequest:
                $ref: '#/components/examples/create_email_connector_request'
              createIndexConnectorRequest:
                $ref: '#/components/examples/create_index_connector_request'
              createWebhookConnectorRequest:
                $ref: '#/components/examples/create_webhook_connector_request'
              createXmattersConnectorRequest:
                $ref: '#/components/examples/create_xmatters_connector_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                createEmailConnectorResponse:
                  $ref: '#/components/examples/create_email_connector_response'
                createIndexConnectorResponse:
                  $ref: '#/components/examples/create_index_connector_response'
                createWebhookConnectorResponse:
                  $ref: '#/components/examples/create_webhook_connector_response'
                createXmattersConnectorResponse:
                  $ref: '#/components/examples/get_connector_response'
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - connectors
      summary: Update a connector
      operationId: put-actions-connector-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: An identifier for the connector.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_connector'
            examples:
              updateIndexConnectorRequest:
                $ref: '#/components/examples/update_index_connector_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/actions/connector/{id}/_execute':
    post:
      tags:
        - connectors
      summary: Run a connector
      description: You can use this API to test an action that involves interaction with Kibana services or integrations with third-party systems.
      operationId: post-actions-connector-id-execute
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: An identifier for the connector.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_execute_request'
            examples:
              runIndexConnectorRequest:
                $ref: '#/components/examples/run_index_connector_request'
              runJiraConnectorRequest:
                $ref: '#/components/examples/run_jira_connector_request'
              runServerLogConnectorRequest:
                $ref: '#/components/examples/run_servicenow_itom_connector_request'
              runSlackConnectorRequest:
                $ref: '#/components/examples/run_slack_api_connector_request'
              runSwimlaneConnectorRequest:
                $ref: '#/components/examples/run_swimlane_connector_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response'
              examples:
                runIndexConnectorResponse:
                  $ref: '#/components/examples/run_index_connector_response'
                runJiraConnectorResponse:
                  $ref: '#/components/examples/run_jira_connector_response'
                runServerLogConnectorResponse:
                  $ref: '#/components/examples/run_server_log_connector_response'
                runServiceNowITOMConnectorResponse:
                  $ref: '#/components/examples/run_servicenow_itom_connector_response'
                runSlackConnectorResponse:
                  $ref: '#/components/examples/run_slack_api_connector_response'
                runSwimlaneConnectorResponse:
                  $ref: '#/components/examples/run_swimlane_connector_response'
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/actions/connectors:
    get:
      tags:
        - connectors
      summary: Get all connectors
      operationId: get-actions-connectors
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_connector_response_with_references_count'
              examples:
                getConnectorsResponse:
                  $ref: '#/components/examples/get_connectors_response'
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/a2a/{agentId}':
    post:
      tags:
        - agent builder
      summary: Send A2A task
      description: "> warn\n> This endpoint is designed for A2A protocol clients and should not be used directly via REST APIs. Use an A2A SDK or A2A Inspector instead.\nTo learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read."
      operationId: post-agent-builder-a2a-agentid
      parameters:
        - name: agentId
          in: path
          description: The unique identifier of the agent to send the A2A task to.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema: { }
            examples:
              a2aTaskRequestExample:
                description: 'WARNING: DO NOT USE THIS ENDPOINT VIA REST API. These examples are auto-generated and should not be run. Integrate with A2A using an A2A SDK or A2A Inspector instead.'
                value:
                  id: task-123
                  jsonrpc: '2.0'
                  method: complete
                  params:
                    messages:
                      - content: Hello from A2A protocol
                        role: user
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                a2aTaskResponseExample:
                  description: Example response from A2A Task Endpoint with results of task execution
                  value:
                    id: task-123
                    jsonrpc: '2.0'
                    result:
                      conversation_id: conv-456
                      response:
                        message: Hello! How can I help you today?
                      type: response
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/a2a/{agentId}.json':
    get:
      tags:
        - agent builder
      summary: Get A2A agent card
      description: 'Get agent discovery metadata in JSON format. Use this endpoint to provide agent information for A2A protocol integration and discovery. To learn more about the Agent Builder A2A server, refer to the [A2A server documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/a2a-server).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-a2a-agentid.json
      parameters:
        - name: agentId
          in: path
          description: The unique identifier of the agent to get A2A metadata for.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                a2aAgentCardResponseExample:
                  description: Example response card of Elastic AI Agent
                  value:
                    capabilities:
                      pushNotifications: false
                      stateTransitionHistory: false
                      streaming: false
                    defaultInputModes:
                      - text/plain
                    defaultOutputModes:
                      - text/plain
                    description: Elastic AI Agent
                    name: Elastic AI Agent
                    protocolVersion: 0.3.0
                    provider:
                      organization: Elastic
                      url: https://elastic.co
                    securitySchemes:
                      authorization:
                        description: Authentication token
                        in: header
                        name: Authorization
                        type: apiKey
                    skills:
                      - description: A powerful tool for searching and analyzing data within your Elasticsearch cluster.
                        examples: [ ]
                        id: platform.core.search
                        inputModes:
                          - text/plain
                          - application/json
                        name: platform.core.search
                        outputModes:
                          - text/plain
                          - application/json
                        tags:
                          - tool
                    supportsAuthenticatedExtendedCard: false
                    url: http://localhost:5601/api/agent_builder/a2a/elastic-ai-agent
                    version: 0.1.0
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/a2a/{agentId}.json\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/a2a/{agentId}.json\n"
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/agents:
    get:
      tags:
        - agent builder
      summary: List agents
      description: 'List all available agents. Use this endpoint to retrieve complete agent information including their current configuration and assigned tools. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-agents
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                listAgentsResponseExample:
                  description: Example response that returns one built-in Elastic agent and one created by the user
                  value:
                    results:
                      - access_control: 'null'
                        configuration:
                          tools:
                            - tool_ids:
                                - platform.core.search
                                - platform.core.list_indices
                                - platform.core.get_index_mapping
                                - platform.core.get_document_by_id
                        description: Elastic AI Agent
                        id: elastic-ai-agent
                        name: Elastic AI Agent
                        permissions:
                          update_access_control: false
                          update_agent: false
                        type: chat
                      - access_control:
                          access_mode: private
                          entries:
                            - name: alice
                              role: manager
                              type: user
                        avatar_color: '#BFDBFF'
                        avatar_symbol: SI
                        configuration:
                          instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                          tools:
                            - tool_ids:
                                - platform.core.search
                                - platform.core.list_indices
                                - platform.core.get_index_mapping
                                - platform.core.get_document_by_id
                        description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                        id: created-agent-id
                        labels:
                          - custom-indices
                          - department-search
                        name: Search Index Helper
                        permissions:
                          update_access_control: true
                          update_agent: true
                        type: chat
      x-codeSamples:
        - lang: curl
          source: "curl \\\n -X GET \"${KIBANA_URL}/api/agent_builder/agents\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/agents\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - agent builder
      summary: Create an agent
      description: 'Create a new agent. Use this endpoint to define the agent''s behavior, appearance, and capabilities through comprehensive configuration options. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.'
      operationId: post-agent-builder-agents
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - id
                - name
                - description
                - configuration
              type: object
              properties:
                access_control:
                  required:
                    - access_mode
                  type: object
                  properties:
                    access_mode:
                      enum:
                        - public
                        - shared
                        - private
                      type: string
                      description: '**Technical Preview; added in 9.4.0.** Access-control mode: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write). Agents created without an access-control mode default to `private`.'
                  additionalProperties: false
                avatar_color:
                  type: string
                  description: Optional hex color code for the agent avatar.
                avatar_symbol:
                  type: string
                  description: Optional symbol/initials for the agent avatar.
                configuration:
                  required:
                    - tools
                  type: object
                  properties:
                    ai_indices:
                      maxItems: 100
                      type: array
                      items:
                        maxLength: 256
                        type: string
                        description: AI indices to associate with the agent.
                      description: Array of AI indices to associate with the agent.
                    connector_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Connector ID to associate with the agent.
                      description: Array of connector IDs to associate with the agent.
                    enable_elastic_capabilities:
                      type: boolean
                      description: 'When true, enables built-in Elastic capabilities for the agent.'
                    instructions:
                      type: string
                      description: Optional system instructions that define the agent behavior.
                    plugin_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Plugin ID to assign to the agent.
                      description: Array of plugin IDs to assign to the agent.
                    post_execution_workflow_ids:
                      maxItems: 100
                      type: array
                      items:
                        maxLength: 512
                        type: string
                        description: 'Optional list of workflow IDs. When set, these workflows run after the agent finishes each round.'
                    skill_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Skill ID to be available to the agent.
                      description: Array of skill IDs to be available to the agent.
                    subagent_ids:
                      maxItems: 50
                      type: array
                      items:
                        maxLength: 64
                        type: string
                        description: Agent ID this agent may spawn as a subagent via `run_subagent`. Use '_self' to enable self-fork.
                      description: '**Technical Preview; added in 9.6.0.** Allowlist of subagent IDs this agent may spawn. Missing or empty disables the `run_subagent` tool. Use ''_self'' to enable self-fork.'
                      x-state: Technical Preview
                    tools:
                      type: array
                      items:
                        required:
                          - tool_ids
                        type: object
                        properties:
                          tool_ids:
                            type: array
                            items:
                              type: string
                              description: Tool ID to be available to the agent.
                            description: Array of tool IDs that the agent can use.
                        additionalProperties: false
                        description: Tool selection configuration for the agent.
                    workflow_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: 'Optional list of workflow IDs. When set, these workflows run before every agent execution, in order.'
                  additionalProperties: false
                  description: Configuration settings for the agent.
                description:
                  type: string
                  description: Description of what the agent does.
                id:
                  type: string
                  description: Unique identifier for the agent.
                labels:
                  type: array
                  items:
                    type: string
                    description: Label for categorizing the agent.
                  description: Optional labels for categorizing and organizing agents.
                name:
                  type: string
                  description: Display name for the agent.
              additionalProperties: false
            examples:
              createAgentRequestExample:
                description: Example request for creating a custom agent with special prompt and tools
                value:
                  avatar_color: '#BFDBFF'
                  avatar_symbol: SI
                  configuration:
                    instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                    tools:
                      - tool_ids:
                          - platform.core.search
                          - platform.core.list_indices
                          - platform.core.get_index_mapping
                          - platform.core.get_document_by_id
                  description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                  id: created-agent-id
                  labels:
                    - custom-indices
                    - department-search
                  name: Search Index Helper
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                createAgentResponseExample:
                  description: Example response returning the definition of an agent created as a result of the request
                  value:
                    avatar_color: '#BFDBFF'
                    avatar_symbol: SI
                    configuration:
                      instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                      tools:
                        - tool_ids:
                            - platform.core.search
                            - platform.core.list_indices
                            - platform.core.get_index_mapping
                            - platform.core.get_document_by_id
                    description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                    id: created-agent-id
                    labels:
                      - custom-indices
                      - department-search
                    name: Search Index Helper
                    type: chat
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/agent_builder/agents\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"id\": \"new-agent-id\",\n    \"name\": \"Search Index Helper\",\n    \"description\": \"Hi! I can help you search the data within the indices starting with \\\"content-\\\" prefix.\",\n    \"labels\": [\"custom-indices\", \"department-search\"],\n    \"avatar_color\": \"#BFDBFF\",\n    \"avatar_symbol\": \"SI\",\n    \"configuration\": {\n      \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n      \"tools\": [\n        {\n          \"tool_ids\": [\n            \"platform.core.search\",\n            \"platform.core.list_indices\",\n            \"platform.core.get_index_mapping\",\n            \"platform.core.get_document_by_id\"\n          ]\n        }\n      ]\n    }\n}'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/agents\n{\n  \"id\": \"new-agent-id\",\n  \"name\": \"Search Index Helper\",\n  \"description\": \"Hi! I can help you search the data within the indices starting with \\\"content-\\\" prefix.\",\n  \"labels\": [\"custom-indices\", \"department-search\"],\n  \"avatar_color\": \"#BFDBFF\",\n  \"avatar_symbol\": \"SI\",\n  \"configuration\": {\n    \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n    \"tools\": [\n      {\n        \"tool_ids\": [\n          \"platform.core.search\",\n          \"platform.core.list_indices\",\n          \"platform.core.get_index_mapping\",\n          \"platform.core.get_document_by_id\"\n        ]\n      }\n    ]\n  }\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/agents/{agent_id}/consumption':
    post:
      tags:
        - agent builder
      summary: Get agent consumption data
      description: 'Returns paginated, per-conversation token consumption data for a given agent. Includes input/output token counts, round counts, LLM call counts, and warnings for conversations with high token usage. Requires the manageAgents privilege. To learn more about monitoring agent token usage, refer to the [monitor usage documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/monitor-usage).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.'
      operationId: post-agent-builder-agents-agent-id-consumption
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agent_id
          in: path
          description: The unique identifier of the agent.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                has_warnings:
                  type: boolean
                  description: Filter to conversations with or without high-token warnings.
                search:
                  type: string
                  description: Free-text search filter on conversation title.
                search_after:
                  maxItems: 10000
                  type: array
                  items: { }
                  description: Cursor for pagination. Pass the search_after value from the previous response.
                size:
                  maximum: 100
                  minimum: 1
                  type: number
                  description: Number of results per page.
                  default: 25
                sort_field:
                  enum:
                    - updated_at
                    - total_tokens
                    - round_count
                  type: string
                  description: Field to sort results by.
                  default: updated_at
                sort_order:
                  enum:
                    - asc
                    - desc
                  type: string
                  description: Sort direction.
                  default: desc
                usernames:
                  maxItems: 10000
                  type: array
                  items:
                    type: string
                  description: Filter results to conversations by these usernames.
              additionalProperties: false
            examples:
              consumptionDefaultExample:
                description: Get consumption data for an agent with default pagination
                value:
                  size: 25
                  sort_field: updated_at
                  sort_order: desc
              consumptionFilteredExample:
                description: Get consumption data filtered by username with warnings
                value:
                  has_warnings: true
                  size: 10
                  sort_field: total_tokens
                  sort_order: desc
                  usernames:
                    - elastic
                    - admin
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                consumptionResponseExample:
                  description: Example response with per-conversation token usage data
                  value:
                    aggregations:
                      total_with_warnings: 0
                      usernames:
                        - elastic
                        - admin
                    results:
                      - conversation_id: conv-abc123
                        created_at: '2025-03-01T10:00:00Z'
                        llm_calls: 8
                        round_count: 5
                        title: Help me search my data
                        token_usage:
                          input_tokens: 15000
                          output_tokens: 3000
                          total_tokens: 18000
                        updated_at: '2025-03-01T10:15:00Z'
                        user:
                          id: uid-1
                          username: elastic
                        warnings: [ ]
                      - conversation_id: conv-def456
                        created_at: '2025-03-02T14:00:00Z'
                        llm_calls: 20
                        round_count: 12
                        title: Analyze server logs
                        token_usage:
                          input_tokens: 250000
                          output_tokens: 8000
                          total_tokens: 258000
                        updated_at: '2025-03-02T14:30:00Z'
                        user:
                          id: uid-2
                          username: admin
                        warnings:
                          - input_tokens: 250000
                            round_id: round-7
                            type: high_input_tokens
                    search_after:
                      - 1709391000000
                      - '2025-03-02T14:30:00Z'
                    total: 2
      x-codeSamples:
        - lang: curl
          source: "curl \\\n -X POST \"${KIBANA_URL}/api/agent_builder/agents/elastic-ai-agent/consumption\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"Content-Type: application/json\" \\\n -H \"elastic-api-version: 2023-10-31\" \\\n -d '{\"size\": 25, \"sort_field\": \"updated_at\", \"sort_order\": \"desc\"}'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/agents/elastic-ai-agent/consumption\n{\"size\": 25, \"sort_field\": \"updated_at\", \"sort_order\": \"desc\"}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/agents/{id}':
    delete:
      tags:
        - agent builder
      summary: Delete an agent
      description: 'Delete an agent by ID. This action cannot be undone. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.'
      operationId: delete-agent-builder-agents-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The unique identifier of the agent to delete.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                deleteAgentResponseExample:
                  description: Example response showing that deletion of the agent has been successful
                  value:
                    success: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/agent_builder/agents/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/agent_builder/agents/{id}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - agent builder
      summary: Get an agent by ID
      description: 'Get a specific agent by ID. Use this endpoint to retrieve the complete agent definition including all configuration details and tool assignments. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-agents-id
      parameters:
        - name: id
          in: path
          description: The unique identifier of the agent to retrieve.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getAgentByIdResponseExample:
                  description: Example response that an agent created by the user that will query elasticsearch indices starting with 'content-' prefix to answer the questions.
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - name: alice
                          role: manager
                          type: user
                    avatar_color: '#BFDBFF'
                    avatar_symbol: SI
                    configuration:
                      instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                      tools:
                        - tool_ids:
                            - platform.core.search
                            - platform.core.list_indices
                            - platform.core.get_index_mapping
                            - platform.core.get_document_by_id
                    description: Hi! I can help you search the data within the indices starting with "content-" prefix.
                    id: created-agent-id
                    labels:
                      - custom-indices
                      - department-search
                    name: Search Index Helper
                    permissions:
                      update_access_control: true
                      update_agent: true
                    type: chat
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/agents/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/agents/{id}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - agent builder
      summary: Update an agent
      description: 'Update an existing agent configuration. Use this endpoint to modify any aspect of the agent''s behavior, appearance, or capabilities. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.'
      operationId: put-agent-builder-agents-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The unique identifier of the agent to update.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                access_control:
                  required:
                    - access_mode
                  type: object
                  properties:
                    access_mode:
                      enum:
                        - public
                        - shared
                        - private
                      type: string
                      description: '**Technical Preview; added in 9.4.0.** Access-control mode: `public` (any privileged user can read/write), `shared` (any privileged user can read, only owner can write), `private` (only owner can read/write). Agents created without an access-control mode default to `private`.'
                  additionalProperties: false
                avatar_color:
                  type: string
                  description: Updated hex color code for the agent avatar.
                avatar_symbol:
                  type: string
                  description: Updated symbol/initials for the agent avatar.
                configuration:
                  type: object
                  properties:
                    ai_indices:
                      maxItems: 100
                      type: array
                      items:
                        maxLength: 256
                        type: string
                        description: AI indices to associate with the agent.
                      description: Array of AI indices to associate with the agent.
                    connector_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Connector ID to associate with the agent.
                      description: Array of connector IDs to associate with the agent.
                    enable_elastic_capabilities:
                      type: boolean
                      description: 'When true, enables built-in Elastic capabilities for the agent.'
                    instructions:
                      type: string
                      description: Updated system instructions that define the agent behavior.
                    plugin_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Plugin ID to assign to the agent.
                      description: Array of plugin IDs to assign to the agent.
                    post_execution_workflow_ids:
                      maxItems: 100
                      type: array
                      items:
                        maxLength: 512
                        type: string
                        description: 'Updated list of workflow IDs. When set, these workflows run after the agent finishes each round.'
                    skill_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Skill ID to be available to the agent.
                      description: Array of skill IDs to be available to the agent.
                    subagent_ids:
                      maxItems: 50
                      type: array
                      items:
                        maxLength: 64
                        type: string
                        description: Agent ID this agent may spawn as a subagent via `run_subagent`. Use '_self' to enable self-fork.
                      description: '**Technical Preview; added in 9.6.0.** Allowlist of subagent IDs this agent may spawn. Missing or empty disables the `run_subagent` tool. Use ''_self'' to enable self-fork.'
                      x-state: Technical Preview
                    tools:
                      type: array
                      items:
                        required:
                          - tool_ids
                        type: object
                        properties:
                          tool_ids:
                            type: array
                            items:
                              type: string
                              description: Tool ID to be available to the agent.
                            description: Array of tool IDs that the agent can use.
                        additionalProperties: false
                        description: Tool selection configuration for the agent.
                    workflow_ids:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: 'Updated list of workflow IDs. When set, these workflows run every agent execution, in order.'
                  additionalProperties: false
                  description: Updated configuration settings for the agent.
                description:
                  type: string
                  description: Updated description of what the agent does.
                labels:
                  type: array
                  items:
                    type: string
                    description: Updated label for categorizing the agent.
                  description: Updated labels for categorizing and organizing agents.
                name:
                  type: string
                  description: Updated display name for the agent.
              additionalProperties: false
            examples:
              createAgentRequestExample:
                description: Example request for updating custom agent
                value:
                  avatar_color: '#BFDBFF'
                  avatar_symbol: SI
                  configuration:
                    instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                    tools:
                      - tool_ids:
                          - platform.core.search
                          - platform.core.list_indices
                          - platform.core.get_index_mapping
                          - platform.core.get_document_by_id
                  description: Updated description - Search for anything in "content-*" indices!
                  id: created-agent-id
                  labels:
                    - custom-indices
                    - department-search
                    - elastic-employees
                  name: Search Index Helper
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateAgentResponseExample:
                  description: Example response returning the agent definition with the changes applied from the request
                  value:
                    avatar_color: '#BFDBFF'
                    avatar_symbol: SI
                    configuration:
                      instructions: You are a custom agent that wants to help searching data using all indices starting with prefix "content-".
                      tools:
                        - tool_ids:
                            - platform.core.search
                            - platform.core.list_indices
                            - platform.core.get_index_mapping
                            - platform.core.get_document_by_id
                    description: Updated description - Search for anything in "content-*" indices!
                    id: created-agent-id
                    labels:
                      - custom-indices
                      - department-search
                      - elastic-employees
                    name: Search Index Helper
                    type: chat
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/agent_builder/agents/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\": \"Search Index Helper\",\n    \"description\": \"Updated description - Search for anything in \\\"content-*\\\" indices!\",\n    \"labels\": [\"custom-indices\", \"department-search\", \"elastic-employees\"],\n    \"avatar_color\": \"#BFDBFF\",\n    \"avatar_symbol\": \"SI\",\n    \"configuration\": {\n      \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n      \"tools\": [{\n        \"tool_ids\": [\n          \"platform.core.search\",\n          \"platform.core.list_indices\",\n          \"platform.core.get_index_mapping\",\n          \"platform.core.get_document_by_id\"\n        ]\n      }]\n    }\n  }'\n"
        - lang: Console
          source: "PUT kbn://api/agent_builder/agents/{id}\n{\n  \"name\": \"Search Index Helper\",\n  \"description\": \"Updated description - Search for anything in \\\"content-*\\\" indices!\",\n  \"labels\": [\"custom-indices\", \"department-search\", \"elastic-employees\"],\n  \"avatar_color\": \"#BFDBFF\",\n  \"avatar_symbol\": \"SI\",\n  \"configuration\": {\n    \"instructions\": \"You are a custom agent that wants to help searching data using all indices starting with prefix \\\"content-\\\".\",\n    \"tools\": [{\n      \"tool_ids\": [\n        \"platform.core.search\",\n        \"platform.core.list_indices\",\n        \"platform.core.get_index_mapping\",\n        \"platform.core.get_document_by_id\"\n      ]\n    }]\n  }\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/agents/{id}/access_control':
    get:
      tags:
        - agent builder
      summary: Get an agent's access control list
      description: 'Get the access control for a specific agent. Callers without permission to manage access control receive `permissions.update_access_control: false` and only their own entry. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-agents-id-access-control
      parameters:
        - name: id
          in: path
          description: The unique identifier of the agent whose access control to retrieve.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getAgentAccessControlMaskedResponseExample:
                  description: Example response for a caller without manage permission — only the caller's own entry is returned.
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - added_at: '2026-02-11T10:15:00.000Z'
                          id: u_bob_profile_uid
                          role: user
                          type: user
                    permissions:
                      update_access_control: false
                getAgentAccessControlResponseExample:
                  description: Example response for a caller who can manage access control — the agent has two grantees keyed on their Kibana user profile uid.
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - added_at: '2026-02-11T10:15:00.000Z'
                          id: u_alice_profile_uid
                          role: editor
                          type: user
                        - added_at: '2026-02-11T10:15:00.000Z'
                          id: u_bob_profile_uid
                          role: user
                          type: user
                    permissions:
                      update_access_control: true
        '404':
          description: 'Not Found — no agent with this ID is visible to the caller. Matches the existing `agentNotFound` shape, so unprivileged callers cannot probe for hidden agents.'
          content:
            application/json:
              examples:
                agentNotFoundResponseExample:
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Agent custom-agent-id not found
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/agents/{id}/access_control\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/agents/{id}/access_control\n"
      x-state: Technical Preview; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - agent builder
      summary: Update an agent's access control list
      description: 'Replace the per-agent access-control entries. Each entry grants one user a role on this agent. Identify the user by their Kibana user profile uid (`id`). Entries created before profile uids were adopted may use `name` (deprecated) instead. The agent owner, cluster admins, and anyone access control grants Manager can call this endpoint. Each call replaces the entire entries list — the most recent successful update wins. To learn more about agents, refer to the [agents documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-agents).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageAgents.'
      operationId: put-agent-builder-agents-id-access-control
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The unique identifier of the agent whose access control to update.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - entries
              type: object
              properties:
                entries:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - type
                      - role
                    type: object
                    properties:
                      id:
                        maxLength: 1024
                        minLength: 1
                        type: string
                        description: Stable identifier of the user to grant access to (Kibana user profile uid). Preferred over `name`.
                        x-state: Technical Preview; added in 9.6.0
                      name:
                        maxLength: 1024
                        minLength: 1
                        type: string
                        description: 'Case-sensitive Kibana username of the user to grant access to. Still supported, but `id` is preferred for new grants because a username cannot distinguish same-named users across authentication realms.'
                      role:
                        enum:
                          - user
                          - editor
                          - manager
                        type: string
                        description: 'Role granted to the principal. Roles are hierarchical: `user` allows viewing, listing, reading, and running the agent; `editor` adds updating the agent configuration; `manager` adds deleting the agent and managing its access control.'
                      type:
                        enum:
                          - user
                        type: string
                    additionalProperties: false
                  description: 'Access-control entries to apply to the agent. Each entry has a `type` (for example `user`), a `role`, and either an `id` (the principal user profile uid, preferred) or a deprecated `name` (username).'
              additionalProperties: false
            examples:
              clearAgentAccessControlRequestExample:
                description: Submit an empty entries list to remove all custom grants. Access then falls back to the agent's access-control mode.
                value:
                  entries: [ ]
              updateAgentAccessControlRequestExample:
                description: 'Example request granting two users access to the agent by their Kibana user profile uid — Alice as Editor (can update the agent configuration), Bob as User (can run the agent).'
                value:
                  entries:
                    - id: u_alice_profile_uid
                      role: editor
                      type: user
                    - id: u_bob_profile_uid
                      role: user
                      type: user
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateAgentAccessControlResponseExample:
                  description: Example response returning the persisted access control after the update.
                  value:
                    access_mode: private
                    entries:
                      - added_at: '2026-02-11T10:15:00.000Z'
                        id: u_alice_profile_uid
                        role: editor
                        type: user
                      - added_at: '2026-02-11T10:15:00.000Z'
                        id: u_bob_profile_uid
                        role: user
                        type: user
        '400':
          description: 'Bad Request — the request body failed validation, or the request targets the built-in Elastic default agent (which cannot have custom access control).'
          content:
            application/json:
              examples:
                accessControlOnDefaultAgentResponseExample:
                  description: 'The built-in Elastic default agent (`elastic-ai-agent`) cannot have custom access control — its access is governed by the platform, not per-agent grants.'
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Bad Request
                    message: The default agent (elastic-ai-agent) does not support custom access controls.
                    statusCode: 400
                tooManyEntriesResponseExample:
                  description: Request body exceeds the 100-entry maximum.
                  value:
                    error: Bad Request
                    message: '[request body.entries]: array size is [101], but cannot be greater than [100]'
                    statusCode: 400
        '404':
          description: 'Not Found — no agent with this ID is visible to the caller, or the caller lacks write access. Matches the existing `agentNotFound` shape so unprivileged callers cannot probe for hidden agents.'
          content:
            application/json:
              examples:
                agentNotFoundResponseExample:
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Agent custom-agent-id not found
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/agent_builder/agents/{id}/access_control\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"entries\": [\n      { \"type\": \"user\", \"id\": \"u_alice_profile_uid\", \"role\": \"editor\" },\n      { \"type\": \"user\", \"id\": \"u_bob_profile_uid\", \"role\": \"user\" }\n    ]\n  }'\n"
        - lang: Console
          source: "PUT kbn://api/agent_builder/agents/{id}/access_control\n{\n  \"entries\": [\n    { \"type\": \"user\", \"id\": \"u_alice_profile_uid\", \"role\": \"editor\" },\n    { \"type\": \"user\", \"id\": \"u_bob_profile_uid\", \"role\": \"user\" }\n  ]\n}\n"
      x-state: Technical Preview; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/conversations:
    get:
      tags:
        - agent builder
      summary: List conversations
      description: 'List all conversations for a user. Use the optional agent ID to filter conversations by a specific agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-conversations
      parameters:
        - name: agent_id
          in: query
          description: Optional agent ID to filter conversations by a specific agent.
          schema:
            maxLength: 64
            type: string
        - name: page
          in: query
          description: 'Page number, 1-based.'
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: Number of results per page. Maximum 1000.
          schema:
            maximum: 1000
            minimum: 1
            type: number
            default: 1000
        - name: sort_order
          in: query
          description: 'Sort direction for results, ordered by updated_at.'
          schema:
            enum:
              - asc
              - desc
            type: string
            default: desc
        - name: pinned
          in: query
          description: Filter to pinned (true) or unpinned (false) conversations. Omit to return all.
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                listConversationsPinnedExample:
                  description: Example response filtered to pinned conversations only
                  value:
                    pagination:
                      page: 1
                      per_page: 1000
                      total: 3
                    results:
                      - agent_id: elastic-ai-agent
                        created_at: '2025-08-01T10:00:00.000Z'
                        id: a1b2c3d4-1234-5678-abcd-000000000001
                        permissions:
                          delete: true
                          rename: true
                        pinned: true
                        title: Important reference conversation
                        updated_at: '2025-09-20T08:30:00.000Z'
                        user:
                          username: elastic
                listConversationsResponseExample:
                  description: Example response returning the first page of conversations for all agents
                  value:
                    pagination:
                      page: 1
                      per_page: 1000
                      total: 128
                    results:
                      - agent_id: elastic-ai-agent
                        attachments:
                          - id: 6f1c0f1e-6c2a-4a0a-9a1e-2f2b1c7d4e11
                            type: text
                          - id: 2b9d7c53-0b8e-4a77-9f0c-91a5d6c3b208
                            type: esql
                        created_at: '2025-09-19T17:45:39.554Z'
                        id: bcc176c5-38f6-40be-be0c-898e34fa1480
                        permissions:
                          delete: true
                          rename: true
                        title: General Greeting
                        updated_at: '2025-09-19T17:45:39.554Z'
                        user:
                          username: elastic
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/conversations?page=1&sort_order=desc\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"elastic-api-version: 2023-10-31\"\n"
        - label: Filter to pinned conversations
          lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/conversations?pinned=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"elastic-api-version: 2023-10-31\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/conversations?page=1&sort_order=desc\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - agent builder
      summary: Create conversation
      description: 'Create an empty conversation without sending a message. Returns the created conversation immediately. Use this to obtain a conversation ID before starting a chat session. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: post-agent-builder-conversations
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                access_control:
                  required:
                    - access_mode
                  type: object
                  properties:
                    access_mode:
                      enum:
                        - private
                        - public
                      type: string
                      description: 'Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation''s agent can read and continue it).'
                    entries:
                      maxItems: 100
                      type: array
                      items:
                        required:
                          - type
                          - id
                          - role
                        type: object
                        properties:
                          id:
                            maxLength: 1024
                            minLength: 1
                            type: string
                            description: 'Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access.'
                          role:
                            enum:
                              - member
                            type: string
                            description: 'Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation.'
                          type:
                            enum:
                              - user
                            type: string
                        additionalProperties: false
                      description: Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected.
                  additionalProperties: false
                  description: Optional access control settings. Defaults to private.
                agent_id:
                  maxLength: 64
                  type: string
                  description: The ID of the agent to associate with the conversation. Defaults to the default Elastic AI agent.
                conversation_id:
                  maxLength: 256
                  type: string
                  description: Optional client-supplied UUID for the conversation. Server-generated if omitted.
                metadata:
                  type: object
                  additionalProperties:
                    anyOf:
                      - maxLength: 10000
                        type: string
                      - type: number
                      - type: boolean
                      - maxItems: 100
                        type: array
                        items:
                          maxLength: 2000
                          type: string
                  description: 'Initial metadata values. Each key must be declared by the referenced template; each value is validated against the field definition (type, options, min/max, regex, max_length). Requires `template_id`.'
                template_id:
                  maxLength: 256
                  minLength: 1
                  type: string
                  description: 'Optional ID of a conversation template to apply. When set, the template seeds default metadata and any caller-supplied `metadata` is validated against the template field definitions.'
                title:
                  maxLength: 500
                  type: string
                  description: Title for the conversation. Defaults to "New conversation".
              additionalProperties: false
            examples:
              createConversationFromTemplateExample:
                description: Example request applying a conversation template and seeding metadata (each key must be declared by the template)
                value:
                  metadata:
                    on_call: true
                    services:
                      - checkout
                      - payments
                    severity: high
                  template_id: incident-response
                  title: Incident triage
              createConversationRequestExample:
                description: Example request for creating a private shared conversation with a custom title and two members
                value:
                  access_control:
                    access_mode: private
                    entries:
                      - id: u_abc123_uid
                        role: member
                        type: user
                      - id: u_def456_uid
                        role: member
                        type: user
                  title: My new conversation
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                createConversationResponseExample:
                  description: Example response returning the newly created conversation
                  value:
                    access_control:
                      access_mode: private
                      entries:
                        - added_at: '2026-08-14T10:00:00.000Z'
                          id: u_abc123_uid
                          role: member
                          type: user
                        - added_at: '2026-08-14T10:00:00.000Z'
                          id: u_def456_uid
                          role: member
                          type: user
                    agent_id: elastic-ai-agent
                    created_at: '2026-08-14T10:00:00.000Z'
                    id: bcc176c5-38f6-40be-be0c-898e34fa1480
                    permissions:
                      delete: true
                      rename: true
                    rounds: [ ]
                    title: My new conversation
                    updated_at: '2026-08-14T10:00:00.000Z'
                    user:
                      username: elastic
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/agent_builder/conversations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"title\": \"My new conversation\",\n    \"access_control\": {\n      \"access_mode\": \"private\",\n      \"entries\": [{ \"type\": \"user\", \"id\": \"u_abc123_uid\", \"role\": \"member\" }]\n    }\n  }'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/conversations\n{\n  \"title\": \"My new conversation\",\n  \"access_control\": {\n    \"access_mode\": \"private\",\n    \"entries\": [{ \"type\": \"user\", \"id\": \"u_abc123_uid\", \"role\": \"member\" }]\n  }\n}\n"
      x-state: Added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}':
    delete:
      tags:
        - agent builder
      summary: Delete conversation by ID
      description: 'Delete a conversation by ID. This action cannot be undone. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: delete-agent-builder-conversations-conversation-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation to delete.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                deleteConversationResponseExample:
                  description: Example response showing that deletion of conversation has been successful
                  value:
                    success: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/agent_builder/conversations/{conversation_id}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - agent builder
      summary: Get conversation by ID
      description: 'Get a specific conversation by ID. Use this endpoint to retrieve the complete conversation history including all messages and metadata. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-conversations-conversation-id
      parameters:
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation to retrieve.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getConversationByIdResponseExample:
                  description: Example response containing the contents of a convesation with the chat agent
                  value:
                    agent_id: elastic-ai-agent
                    created_at: '2025-09-19T17:45:39.554Z'
                    id: bcc176c5-38f6-40be-be0c-898e34fa1480
                    permissions:
                      delete: true
                      rename: true
                    rounds:
                      - feedback:
                          chips:
                            - accurate
                            - useful
                          comment: ''
                          submitted_at: '2025-09-19T17:46:12.000Z'
                          vote: up
                        id: 170ec3b2-0f5a-4538-8b60-549572386d2a
                        input:
                          message: 'Hello, how are you?'
                        response:
                          message: "Since this is a general greeting that doesn't require any organizational or product-specific information, I can respond without using tools.\n\nHello! I'm doing well, thank you for asking. I'm here to help you with any questions you may have. How can I assist you today?"
                        steps: [ ]
                    title: General Greeting
                    updated_at: '2025-09-19T17:45:39.554Z'
                    user:
                      username: elastic
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/conversations/{conversation_id}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/_add_events':
    post:
      tags:
        - agent builder
      summary: Add events to a conversation
      description: 'Append custom events to a conversation''s timeline. The caller must be the owner, a member, or the conversation must be public. Server assigns id, created_at, and actor for each event; the body provides type and data. Only registered custom event types are accepted — built-in lifecycle types are rejected. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: post-agent-builder-conversations-conversation-id-add-events
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - events
              type: object
              properties:
                events:
                  maxItems: 10
                  minItems: 1
                  type: array
                  items:
                    required:
                      - type
                      - data
                    type: object
                    properties:
                      data:
                        type: object
                        description: The event payload. Its shape is defined by the event type.
                      type:
                        maxLength: 256
                        minLength: 1
                        type: string
                        description: The registered custom event type.
                    additionalProperties: false
                  description: Events to append. Between 1 and 10.
              additionalProperties: false
            examples:
              addEventsRequestExample:
                description: Example request appending two custom events to a conversation
                value:
                  events:
                    - data:
                        text: First note on this conversation
                      type: text_note
                    - data:
                        text: Second note on this conversation
                      type: text_note
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                addEventsResponseExample:
                  description: Example response returning the materialized events with server-assigned fields
                  value:
                    events:
                      - actor:
                          id: u_abc123_uid
                          type: user
                          username: elastic
                        created_at: '2026-09-14T10:00:00.000Z'
                        data:
                          text: First note on this conversation
                        id: 7d3f1a2b-4c5e-6f7a-8b9c-0d1e2f3a4b5c
                        type: text_note
                      - actor:
                          id: u_abc123_uid
                          type: user
                          username: elastic
                        created_at: '2026-09-14T10:00:00.000Z'
                        data:
                          text: Second note on this conversation
                        id: 8e4f2b3c-5d6f-7a8b-9c0d-1e2f3a4b5c6d
                        type: text_note
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/agent_builder/conversations/${CONVERSATION_ID}/_add_events\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"elastic-api-version: 2023-10-31\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"events\": [\n      { \"type\": \"text_note\", \"data\": { \"text\": \"A note on this conversation\" } }\n    ]\n  }'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/conversations/${CONVERSATION_ID}/_add_events\n{\n  \"events\": [\n    { \"type\": \"text_note\", \"data\": { \"text\": \"A note on this conversation\" } }\n  ]\n}\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/access_control':
    put:
      tags:
        - agent builder
      summary: Update a conversation's access control
      description: 'Replace a conversation''s access mode and member list. Only the conversation owner can call this endpoint; every other caller receives a not-found response. Each call replaces the entire access control — the most recent successful update wins. Members can read and continue the conversation, but still need access to the conversation''s agent. To learn more about agent conversations, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: put-agent-builder-conversations-conversation-id-access-control
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation whose access control to update.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - access_mode
                - entries
              type: object
              properties:
                access_mode:
                  enum:
                    - private
                    - public
                  type: string
                  description: 'Access-control mode: `private` (only the owner and the listed members can read and continue the conversation), `public` (any user with access to the conversation''s agent can read and continue it).'
                entries:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - type
                      - id
                      - role
                    type: object
                    properties:
                      id:
                        maxLength: 1024
                        minLength: 1
                        type: string
                        description: 'Stable identifier of the user to share the conversation with: a Kibana user profile uid. Users without a profile cannot be granted access.'
                      role:
                        enum:
                          - member
                        type: string
                        description: 'Role granted to the principal. `member` is the only role: it grants read and converse access to the conversation.'
                      type:
                        enum:
                          - user
                        type: string
                    additionalProperties: false
                  description: Members to share the conversation with. The list replaces the stored one; submit an empty list to unshare. Entries naming the owner are ignored. Must be empty when `access_mode` is `public`; repeated ids are rejected.
              additionalProperties: false
            examples:
              publishConversationRequestExample:
                description: 'Switch the conversation to `public` so any user with access to its agent can read and continue it. A public conversation is already open to everyone with agent access, so `entries` must be empty.'
                value:
                  access_mode: public
                  entries: [ ]
              shareConversationRequestExample:
                description: 'Example request sharing a private conversation with two users. They can read and continue the conversation, provided they also have access to its agent.'
                value:
                  access_mode: private
                  entries:
                    - id: u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0
                      role: member
                      type: user
                    - id: u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0
                      role: member
                      type: user
              unshareConversationRequestExample:
                description: Submit an empty entries list to remove every member. Access then falls back to the access mode alone.
                value:
                  access_mode: private
                  entries: [ ]
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateConversationAccessControlResponseExample:
                  description: Example response returning the persisted access control. `added_at` is stamped by the server for newly added members and preserved for members that were already listed.
                  value:
                    access_mode: private
                    entries:
                      - added_at: '2026-08-11T10:00:00.000Z'
                        id: u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0
                        role: member
                        type: user
                      - added_at: '2026-08-11T11:30:00.000Z'
                        id: u_9xXGnqPB4mLTNhOlHMHXqYbGrGFOTuQIRWlqLpKq0dE_0
                        role: member
                        type: user
        '400':
          description: Bad Request — the request body failed validation.
          content:
            application/json:
              examples:
                duplicateEntryResponseExample:
                  description: Two entries name the same user id.
                  value:
                    error: Bad Request
                    message: Duplicate ACL entry for user "u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0"
                    statusCode: 400
                entriesWithPublicModeResponseExample:
                  description: '`entries` must be empty when `access_mode` is `public` — a public conversation is already open to everyone with agent access.'
                  value:
                    error: Bad Request
                    message: ACL entries are not supported when access_mode is "public"
                    statusCode: 400
                tooManyEntriesResponseExample:
                  description: Request body exceeds the 100-member maximum.
                  value:
                    error: Bad Request
                    message: '[request body.entries]: array size is [101], but cannot be greater than [100]'
                    statusCode: 400
        '404':
          description: 'Not Found — no conversation with this ID is readable by the caller, or the caller is not its owner. Matches the existing `conversationNotFound` shape, so members cannot distinguish a conversation they may not re-share from one that does not exist.'
          content:
            application/json:
              examples:
                conversationNotFoundResponseExample:
                  value:
                    attributes:
                      trace_id: 8d4f2a3b-1c5e-4a9b-9f0d-2e6c1a3d4f5e
                    error: Not Found
                    message: Conversation my-conversation-id not found
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/agent_builder/conversations/{conversation_id}/access_control\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"access_mode\": \"private\",\n    \"entries\": [\n      { \"type\": \"user\", \"id\": \"u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\", \"role\": \"member\" }\n    ]\n  }'\n"
        - lang: Console
          source: "PUT kbn://api/agent_builder/conversations/{conversation_id}/access_control\n{\n  \"access_mode\": \"private\",\n  \"entries\": [\n    { \"type\": \"user\", \"id\": \"u_kd2Wm6QCf9nBBqGGyfxBcQxIrgLLLLxbPHOTNHOTgWM_0\", \"role\": \"member\" }\n  ]\n}\n"
      x-state: Technical Preview; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/attachments':
    get:
      tags:
        - agent builder
      summary: List conversation attachments
      description: 'List all attachments for a conversation. Use the optional include_deleted query parameter to include soft-deleted attachments.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-conversations-conversation-id-attachments
      parameters:
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: include_deleted
          in: query
          description: Whether to include deleted attachments in the list.
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                listAttachmentsResponseExample:
                  description: Example response containing active attachments for a conversation
                  value:
                    results:
                      - active: true
                        current_version: 2
                        description: My text file
                        id: attachment-1
                        type: text
                        versions:
                          - content_hash: abc123
                            created_at: '2025-01-01T10:00:00.000Z'
                            data: Initial content
                            estimated_tokens: 3
                            version: 1
                          - content_hash: def456
                            created_at: '2025-01-01T11:00:00.000Z'
                            data: Updated content
                            estimated_tokens: 3
                            version: 2
                      - active: true
                        current_version: 1
                        description: Configuration data
                        id: attachment-2
                        type: json
                        versions:
                          - content_hash: ghi789
                            created_at: '2025-01-01T12:00:00.000Z'
                            data:
                              key: value
                              nested:
                                field: 123
                            estimated_tokens: 15
                            version: 1
                    total_token_estimate: 21
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - agent builder
      summary: Create conversation attachment
      description: 'Create a new attachment for a conversation with version tracking.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: post-agent-builder-conversations-conversation-id-attachments
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - type
                - data
              type: object
              properties:
                data:
                  description: The attachment data/content. Required unless origin is provided.
                description:
                  maxLength: 2048
                  type: string
                  description: Human-readable description of the attachment.
                hidden:
                  type: boolean
                  description: Whether the attachment should be hidden from the user.
                id:
                  maxLength: 256
                  type: string
                  description: Optional custom ID for the attachment.
                origin:
                  maxLength: 2048
                  type: string
                  description: 'Origin string (for example, saved object ID) for by-reference attachments. When provided without data, the content is resolved once at creation time.'
                render_inline:
                  type: boolean
                  description: 'When true, the attachment is rendered inline in the UI when the conversation is opened, without the agent referencing it.'
                  default: false
                type:
                  maxLength: 256
                  type: string
                  description: 'The type of the attachment (e.g., text, esql, visualization).'
              additionalProperties: false
            examples:
              createHiddenAttachmentExample:
                description: Example request for creating a hidden attachment
                value:
                  data: Internal system data
                  description: System context
                  hidden: true
                  type: text
              createJsonAttachmentExample:
                description: Example request for creating a JSON attachment with custom ID
                value:
                  data:
                    configuration:
                      enabled: true
                      threshold: 50
                    metadata:
                      source: user_input
                  description: Application settings
                  id: custom-attachment-id
                  type: json
              createTextAttachmentExample:
                description: Example request for creating a text attachment
                value:
                  data: This is the content of my text attachment
                  description: Meeting notes
                  type: text
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                createAttachmentResponseExample:
                  description: Example response returning the created attachment
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Meeting notes
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: This is the content of my text attachment
                          estimated_tokens: 12
                          version: 1
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}':
    delete:
      tags:
        - agent builder
      summary: Delete conversation attachment
      description: 'Delete an attachment. By default performs a soft delete (can be restored). Use permanent=true to permanently remove unreferenced attachments.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: delete-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: attachment_id
          in: path
          description: The unique identifier of the attachment to delete.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: permanent
          in: query
          description: 'If true, permanently removes the attachment (only for unreferenced attachments).'
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                permanentDeleteAttachmentResponseExample:
                  description: Example response for permanent delete (cannot be restored)
                  value:
                    permanent: true
                    success: true
                softDeleteAttachmentResponseExample:
                  description: Example response for soft delete (can be restored)
                  value:
                    permanent: false
                    success: true
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - agent builder
      summary: Get conversation attachment
      description: 'Get a single attachment by ID for a conversation.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: attachment_id
          in: path
          description: The unique identifier of the attachment.
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getAttachmentResponseExample:
                  description: Example response containing a single attachment
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: My text file
                      id: attachment-1
                      type: text
                      versions:
                        - content_hash: abc123
                          created_at: '2025-01-01T10:00:00.000Z'
                          data: File content
                          estimated_tokens: 2
                          version: 1
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - agent builder
      summary: Rename attachment
      description: 'Rename an attachment without creating a new version.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: patch-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: attachment_id
          in: path
          description: The unique identifier of the attachment to rename.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - description
              type: object
              properties:
                description:
                  maxLength: 2048
                  type: string
                  description: The new description/name for the attachment.
              additionalProperties: false
            examples:
              renameAttachmentExample:
                description: Example request for renaming an attachment
                value:
                  description: Updated attachment name
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                renameAttachmentResponseExample:
                  description: Example response returning the renamed attachment (version unchanged)
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Updated attachment name
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: Content remains the same
                          estimated_tokens: 10
                          version: 1
                    success: true
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - agent builder
      summary: Update conversation attachment
      description: 'Update an attachment content. Creates a new version if content changed.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: put-agent-builder-conversations-conversation-id-attachments-attachment-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: attachment_id
          in: path
          description: The unique identifier of the attachment to update.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - data
              type: object
              properties:
                data:
                  description: The new attachment data/content.
                description:
                  maxLength: 2048
                  type: string
                  description: Optional new description for the attachment.
                render_inline:
                  type: boolean
                  description: 'When true, the attachment is rendered inline in the UI when the conversation is opened, without the agent referencing it.'
                  default: false
              additionalProperties: false
            examples:
              updateAttachmentContentExample:
                description: Example request for updating attachment content
                value:
                  data: This is the updated content
              updateAttachmentWithDescriptionExample:
                description: Example request for updating both content and description
                value:
                  data: New content version
                  description: Updated meeting notes - v2
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateAttachmentResponseExample:
                  description: Example response returning the updated attachment with new version
                  value:
                    attachment:
                      active: true
                      current_version: 2
                      description: Meeting notes
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-abc
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: Original content
                          estimated_tokens: 10
                          version: 1
                        - content_hash: sha256-def
                          created_at: '2025-01-06T11:00:00.000Z'
                          data: This is the updated content
                          estimated_tokens: 12
                          version: 2
                    new_version: 2
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/_restore':
    post:
      tags:
        - agent builder
      summary: Restore deleted attachment
      description: 'Restore a soft-deleted attachment.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: post-agent-builder-conversations-conversation-id-attachments-attachment-id-restore
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: attachment_id
          in: path
          description: The unique identifier of the attachment to restore.
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                restoreAttachmentResponseExample:
                  description: Example response returning the restored attachment
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Restored attachment
                      id: att-abc123
                      type: text
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data: Restored content
                          estimated_tokens: 10
                          version: 1
                    success: true
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/attachments/{attachment_id}/origin':
    put:
      tags:
        - agent builder
      summary: Update attachment origin
      description: 'Update the origin reference for an attachment. Use this after saving a by-value attachment to link it to its persistent store.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: put-agent-builder-conversations-conversation-id-attachments-attachment-id-origin
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: attachment_id
          in: path
          description: The unique identifier of the attachment to update.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - origin
              type: object
              properties:
                origin:
                  maxLength: 2048
                  type: string
                  description: 'The origin string (e.g., saved object ID for visualizations and dashboards).'
              additionalProperties: false
            examples:
              updateOriginExample:
                description: Example request for linking an attachment to a saved visualization
                value:
                  origin: abc123
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateOriginResponseExample:
                  description: Example response returning the attachment with updated origin
                  value:
                    attachment:
                      active: true
                      current_version: 1
                      description: Sales chart
                      id: att-123
                      origin: abc123
                      type: visualization
                      versions:
                        - content_hash: sha256-xyz
                          created_at: '2025-01-06T10:00:00.000Z'
                          data:
                            chart_type: bar
                            esql: FROM sales | STATS count=COUNT(*) BY month
                            query: Show monthly sales
                            visualization: { }
                          estimated_tokens: 50
                          version: 1
                    success: true
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/conversations/{conversation_id}/attachments/stale':
    get:
      tags:
        - agent builder
      summary: Check attachment staleness
      description: 'Checks staleness for the latest version of all conversation attachments against their origin snapshot.<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-conversations-conversation-id-attachments-stale
      parameters:
        - name: conversation_id
          in: path
          description: The unique identifier of the conversation.
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                checkStaleAttachmentsResponseExample:
                  description: 'Mixed conversation: attachments without a stale source return only id and is_stale. When a staleness check fails for one attachment, is_stale is false and an error explains why. When an origin-backed attachment is out of date, the response includes type, origin, and resolved data (here a simple text body) for resync.'
                  value:
                    attachments:
                      - id: att-text-meeting-notes
                        is_stale: false
                      - id: att-lens-active-users
                        is_stale: false
                      - error: Origin could not be resolved
                        id: att-query-attachment
                        is_stale: false
                      - data: This is the content of my text attachment
                        hidden: false
                        id: att-text-runbook
                        is_stale: true
                        origin: document:hr-onboarding-v2
                        type: text
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/converse:
    post:
      tags:
        - agent builder
      summary: Send chat message
      description: 'Send a message to an agent and receive a complete response. This synchronous endpoint waits for the agent to fully process your request before returning the final result. Use this for simple chat interactions where you need the complete response. To learn more about agent chat, refer to the [agent chat documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/chat).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: post-agent-builder-converse
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                _execution_mode:
                  enum:
                    - local
                    - task_manager
                  type: string
                  description: define how to execute the agent (local execution or via task_manager)
                  x-state: Experimental; added in 9.4.0
                access_control:
                  required:
                    - access_mode
                  type: object
                  properties:
                    access_mode:
                      enum:
                        - private
                        - public
                      type: string
                      description: Access mode to apply when creating a new conversation. Set to public to make the conversation visible to other users who can access the underlying agent. This setting is ignored when continuing an existing conversation.
                  additionalProperties: false
                  description: Optional conversation access control. Defaults to private.
                  x-state: Technical Preview; added in 9.5.0
                action:
                  enum:
                    - regenerate
                  type: string
                  description: Deprecated and ignored. The "regenerate" action has been removed; the field is still accepted for backward compatibility.
                  deprecated: true
                agent_id:
                  type: string
                  description: The ID of the agent to chat with. Defaults to the default Elastic AI agent.
                  default: elastic-ai-agent
                attachments:
                  type: array
                  items:
                    required:
                      - type
                    type: object
                    properties:
                      data:
                        type: object
                        additionalProperties: { }
                        description: Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time).
                      description:
                        maxLength: 1024
                        type: string
                        description: Human-readable label for the attachment.
                      group_id:
                        maxLength: 256
                        type: string
                        description: Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity.
                      hidden:
                        type: boolean
                        description: 'When true, the attachment will not be displayed in the UI.'
                      id:
                        type: string
                        description: Optional id for the attachment.
                      origin:
                        type: string
                        description: 'Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook.'
                      type:
                        type: string
                        description: Type of the attachment.
                    additionalProperties: false
                  description: Optional attachments to send with the message.
                  x-state: Technical Preview; added in 9.3.0
                browser_api_tools:
                  type: array
                  items:
                    required:
                      - id
                      - description
                      - schema
                    type: object
                    properties:
                      description:
                        type: string
                        description: Description of what the browser API tool does.
                      id:
                        type: string
                        description: Unique identifier for the browser API tool.
                      schema:
                        description: JSON Schema defining the tool parameters (JsonSchema7Type).
                    additionalProperties: false
                  description: Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side.
                configuration_overrides:
                  type: object
                  properties:
                    enable_elastic_capabilities:
                      type: boolean
                      description: Whether to enable built-in Elastic skills for this execution.
                    instructions:
                      type: string
                      description: Custom instructions for the agent.
                    skill_ids:
                      maxItems: 100
                      type: array
                      items:
                        maxLength: 256
                        type: string
                      description: 'Skill IDs to enable for this execution, replacing the stored skill list. Note: only fully restricts the available skill set when enable_elastic_capabilities is also set to false.'
                    tools:
                      type: array
                      items:
                        required:
                          - tool_ids
                        type: object
                        properties:
                          tool_ids:
                            type: array
                            items:
                              type: string
                        additionalProperties: false
                      description: Tool selection to enable for this execution.
                  additionalProperties: false
                  description: Runtime configuration overrides. These override the stored agent configuration for this execution only.
                connector_id:
                  type:
                    - 'null'
                    - string
                  description: Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one.
                conversation_id:
                  maxLength: 256
                  type: string
                  description: Optional existing conversation ID to continue a previous conversation.
                execution_id:
                  type: string
                  description: 'Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID.'
                inference_id:
                  type:
                    - 'null'
                    - string
                  description: Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`.
                input:
                  type: string
                  description: The user input message to send to the agent.
                project_routing:
                  maxLength: 2048
                  type: string
                  description: 'Cross-project search routing expression resolved from the header project picker, applied to the run''s searches. Serverless (CPS) only; ignored elsewhere.'
                prompts:
                  type: object
                  additionalProperties:
                    anyOf:
                      - required:
                          - allow
                        type: object
                        properties:
                          allow:
                            type: boolean
                        additionalProperties: false
                      - required:
                          - authorized
                        type: object
                        properties:
                          authorized:
                            type: boolean
                        additionalProperties: false
                      - required:
                          - answers
                        type: object
                        properties:
                          answers:
                            maxItems: 100
                            type: array
                            items:
                              type: object
                              properties:
                                choice:
                                  maxItems: 100
                                  type: array
                                  items:
                                    type: number
                                custom:
                                  maxLength: 20000
                                  minLength: 1
                                  type: string
                                skipped:
                                  type: boolean
                              additionalProperties: false
                        additionalProperties: false
                        description: 'Answers to an `ask_user_question` prompt; one entry per question, in order.'
                        x-state: Technical Preview
                  description: 'Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt.'
                read_only:
                  type: boolean
                  description: 'When true, the created conversation is presented as read-only in the UI: its history is shown but no message input is offered. This carries no authorization meaning — the conversation can still be continued through the API. This setting is ignored when continuing an existing conversation.'
                  x-state: Technical Preview; added in 9.6.0
                reasoning_level:
                  enum:
                    - none
                    - minimal
                    - low
                    - medium
                    - high
                    - xhigh
                  type: string
                  description: 'Reasoning effort level for the LLM. One of: none, minimal, low, medium, high, xhigh. Support depends on the underlying model and provider.'
                  x-state: Experimental; added in 9.6.0
              additionalProperties: false
            examples:
              conversePublicRequestExample:
                description: Example request to create a public conversation
                value:
                  access_control:
                    access_mode: public
                  agent_id: elastic-ai-agent
                  connector_id: my-connector-id
                  input: What is Elasticsearch?
              converseRequestExample:
                description: Example request to send a message to the agent as a part of the conversation
                value:
                  agent_id: elastic-ai-agent
                  connector_id: my-connector-id
                  input: What is Elasticsearch?
              converseRequestInferenceExample:
                description: Example using inference_id (mutually exclusive with connector_id)
                value:
                  agent_id: elastic-ai-agent
                  inference_id: my-inference-endpoint-id
                  input: What is Elasticsearch?
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                converseResponseExample:
                  description: Example response containing the chain of events representing a conversation with the agent
                  value:
                    access_control:
                      access_mode: private
                    conversation_id: 696ccd6d-4bff-4b26-a62e-522ccf2dcd16
                    response:
                      message: 'Elasticsearch is a distributed, RESTful search and analytics engine capable of addressing a growing number of use cases. As the heart of the Elastic Stack, it centrally stores your data for lightning fast search, fine‑tuned relevancy, and powerful analytics that scale with ease.'
                    steps:
                      - reasoning: Searching for official documentation or content that explains what Elasticsearch is
                        type: reasoning
                      - params:
                          query: what is elasticsearch definition overview introduction
                        progression:
                          - message: Selecting the best target for this query
                        results:
                          - data:
                              message: Could not figure out which index to use
                            type: error
                        tool_call_id: tooluse_shOdUwKIRwC9YhqGzeg0cQ
                        tool_id: platform.core.search
                        type: tool_call
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/agent_builder/converse\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"input\": \"What is Elasticsearch?\",\n    \"agent_id\": \"elastic-ai-agent\",\n    \"access_control\": {\n      \"access_mode\": \"public\"\n    }\n  }'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/converse\n{\n  \"input\": \"What is Elasticsearch?\",\n  \"agent_id\": \"elastic-ai-agent\",\n  \"access_control\": {\n    \"access_mode\": \"public\"\n  }\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/converse/async:
    post:
      tags:
        - agent builder
      summary: Send chat message (streaming)
      description: "Send a message to an agent and receive real-time streaming events. This asynchronous endpoint provides live updates as the agent processes your request, allowing you to see intermediate steps and progress. Use this for interactive experiences where you want to monitor the agent's thinking process.\n\n## Event types\n\nThe endpoint emits Server-Sent Events (SSE) with the following custom event types:\n\n`conversation_id_set`\n\nSets the conversation ID.\n\nSchema:\n```json\n{\n  \"conversation_id\": \"uuid\"\n}\n```\n\n---\n\n`conversation_created`\n\nFires when a new conversation is persisted and assigned an ID.\n\nSchema:\n```json\n{\n  \"conversation_id\": \"uuid\",\n  \"title\": \"conversation title\"\n}\n```\n\n---\n\n`conversation_updated`\n\nFires when a conversation is updated.\n\nSchema:\n```json\n{\n  \"conversation_id\": \"uuid\",\n  \"title\": \"updated conversation title\"\n}\n```\n\n---\n\n`reasoning`\n\nHandles reasoning-related data.\n\nSchema:\n```json\n{\n  \"reasoning\": \"plain text reasoning content\",\n  \"transient\": false\n}\n```\n\n---\n\n`tool_call`\n\nTriggers when a tool is invoked.\n\nSchema:\n```json\n{\n  \"tool_call_id\": \"uuid\",\n  \"tool_id\": \"tool_name\",\n  \"params\": {}\n}\n```\n\n---\n\n`tool_progress`\n\nReports progress of a running tool.\n\nSchema:\n```json\n{\n  \"tool_call_id\": \"uuid\",\n  \"message\": \"progress message\"\n}\n```\n\n---\n\n`tool_result`\n\nReturns results from a completed tool call.\n\nSchema:\n```json\n{\n  \"tool_call_id\": \"uuid\",\n  \"tool_id\": \"tool_name\",\n  \"results\": []\n}\n```\n\n**Note:** `results` is an array of `ToolResult` objects.\n\n---\n\n`message_chunk`\n\nStreams partial text chunks.\n\nSchema:\n```json\n{\n  \"message_id\": \"uuid\",\n  \"text_chunk\": \"partial text\"\n}\n```\n\n---\n\n`message_complete`\n\nIndicates message stream is finished.\n\nSchema:\n```json\n{\n  \"message_id\": \"uuid\",\n  \"message_content\": \"full text content of the message\"\n}\n```\n\n---\n\n`thinking_complete`\n\nMarks the end of the thinking/reasoning phase.\n\nSchema:\n```json\n{\n  \"time_to_first_token\": 0\n}\n```\n\n**Note:** `time_to_first_token` is in milliseconds.\n\n---\n\n`round_complete`\n\nMarks end of one conversation round.\n\nSchema:\n```json\n{\n  \"round\": {}\n}\n```\n\n**Note:** `round` contains the full round json object.\n\n---\n\n## Event flow\n\nA typical conversation round emits events in this sequence:\n\n1. `reasoning` (potentially multiple, some transient)\n2. `tool_call` (if tools are used)\n3. `tool_progress` (zero or more progress updates)\n4. `tool_result` (when tool completes)\n5. `thinking_complete`\n6. `message_chunk` (multiple, as text streams)\n7. `message_complete`\n8. `round_complete`\n\n<br/><br/>[Required authorization] Route required privileges: agentBuilder:read."
      operationId: post-agent-builder-converse-async
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                _execution_mode:
                  enum:
                    - local
                    - task_manager
                  type: string
                  description: define how to execute the agent (local execution or via task_manager)
                  x-state: Experimental; added in 9.4.0
                access_control:
                  required:
                    - access_mode
                  type: object
                  properties:
                    access_mode:
                      enum:
                        - private
                        - public
                      type: string
                      description: Access mode to apply when creating a new conversation. Set to public to make the conversation visible to other users who can access the underlying agent. This setting is ignored when continuing an existing conversation.
                  additionalProperties: false
                  description: Optional conversation access control. Defaults to private.
                  x-state: Technical Preview; added in 9.5.0
                action:
                  enum:
                    - regenerate
                  type: string
                  description: Deprecated and ignored. The "regenerate" action has been removed; the field is still accepted for backward compatibility.
                  deprecated: true
                agent_id:
                  type: string
                  description: The ID of the agent to chat with. Defaults to the default Elastic AI agent.
                  default: elastic-ai-agent
                attachments:
                  type: array
                  items:
                    required:
                      - type
                    type: object
                    properties:
                      data:
                        type: object
                        additionalProperties: { }
                        description: Payload of the attachment. Required unless `origin` is provided (content is resolved once at send time).
                      description:
                        maxLength: 1024
                        type: string
                        description: Human-readable label for the attachment.
                      group_id:
                        maxLength: 256
                        type: string
                        description: Stable identifier for the logical group this attachment belongs to. Attachments sharing the same group_id were submitted together as a single logical entity.
                      hidden:
                        type: boolean
                        description: 'When true, the attachment will not be displayed in the UI.'
                      id:
                        type: string
                        description: Optional id for the attachment.
                      origin:
                        type: string
                        description: 'Origin string (for example, saved object ID) for by-reference attachments. When provided without `data`, the content is resolved once using the attachment type’s `resolve` hook.'
                      type:
                        type: string
                        description: Type of the attachment.
                    additionalProperties: false
                  description: Optional attachments to send with the message.
                  x-state: Technical Preview; added in 9.3.0
                browser_api_tools:
                  type: array
                  items:
                    required:
                      - id
                      - description
                      - schema
                    type: object
                    properties:
                      description:
                        type: string
                        description: Description of what the browser API tool does.
                      id:
                        type: string
                        description: Unique identifier for the browser API tool.
                      schema:
                        description: JSON Schema defining the tool parameters (JsonSchema7Type).
                    additionalProperties: false
                  description: Optional browser API tools to be registered as LLM tools with browser.* namespace. These tools execute on the client side.
                configuration_overrides:
                  type: object
                  properties:
                    enable_elastic_capabilities:
                      type: boolean
                      description: Whether to enable built-in Elastic skills for this execution.
                    instructions:
                      type: string
                      description: Custom instructions for the agent.
                    skill_ids:
                      maxItems: 100
                      type: array
                      items:
                        maxLength: 256
                        type: string
                      description: 'Skill IDs to enable for this execution, replacing the stored skill list. Note: only fully restricts the available skill set when enable_elastic_capabilities is also set to false.'
                    tools:
                      type: array
                      items:
                        required:
                          - tool_ids
                        type: object
                        properties:
                          tool_ids:
                            type: array
                            items:
                              type: string
                        additionalProperties: false
                      description: Tool selection to enable for this execution.
                  additionalProperties: false
                  description: Runtime configuration overrides. These override the stored agent configuration for this execution only.
                connector_id:
                  type:
                    - 'null'
                    - string
                  description: Optional connector ID for the agent to use for model routing. Mutually exclusive with `inference_id`; omit or use only one.
                conversation_id:
                  maxLength: 256
                  type: string
                  description: Optional existing conversation ID to continue a previous conversation.
                execution_id:
                  type: string
                  description: 'Optional client-generated execution ID. Provide it to address this execution later (for example, to abort it). Must be unique; defaults to a server-generated ID.'
                inference_id:
                  type:
                    - 'null'
                    - string
                  description: Optional inference endpoint ID for model routing (public alias for the same internal identifier as `connector_id`). Mutually exclusive with `connector_id`.
                input:
                  type: string
                  description: The user input message to send to the agent.
                project_routing:
                  maxLength: 2048
                  type: string
                  description: 'Cross-project search routing expression resolved from the header project picker, applied to the run''s searches. Serverless (CPS) only; ignored elsewhere.'
                prompts:
                  type: object
                  additionalProperties:
                    anyOf:
                      - required:
                          - allow
                        type: object
                        properties:
                          allow:
                            type: boolean
                        additionalProperties: false
                      - required:
                          - authorized
                        type: object
                        properties:
                          authorized:
                            type: boolean
                        additionalProperties: false
                      - required:
                          - answers
                        type: object
                        properties:
                          answers:
                            maxItems: 100
                            type: array
                            items:
                              type: object
                              properties:
                                choice:
                                  maxItems: 100
                                  type: array
                                  items:
                                    type: number
                                custom:
                                  maxLength: 20000
                                  minLength: 1
                                  type: string
                                skipped:
                                  type: boolean
                              additionalProperties: false
                        additionalProperties: false
                        description: 'Answers to an `ask_user_question` prompt; one entry per question, in order.'
                        x-state: Technical Preview
                  description: 'Use this field to respond to a `confirmation`, `authorization`, or `ask_user_question` prompt. Send an `allow` boolean to answer a `confirmation` prompt, an `authorized` boolean to answer an `authorization` prompt, or an `answers` array (one entry per question) to answer an `ask_user_question` prompt.'
                read_only:
                  type: boolean
                  description: 'When true, the created conversation is presented as read-only in the UI: its history is shown but no message input is offered. This carries no authorization meaning — the conversation can still be continued through the API. This setting is ignored when continuing an existing conversation.'
                  x-state: Technical Preview; added in 9.6.0
                reasoning_level:
                  enum:
                    - none
                    - minimal
                    - low
                    - medium
                    - high
                    - xhigh
                  type: string
                  description: 'Reasoning effort level for the LLM. One of: none, minimal, low, medium, high, xhigh. Support depends on the underlying model and provider.'
                  x-state: Experimental; added in 9.6.0
              additionalProperties: false
            examples:
              converseAsyncPublicRequestExample:
                description: Example request to create a public conversation
                value:
                  access_control:
                    access_mode: public
                  agent_id: elastic-ai-agent
                  input: Hello
              converseAsyncRequestExample:
                description: Example request to send a message to the agent as a part of the conversation
                value:
                  agent_id: elastic-ai-agent
                  conversation_id: c250305b-1929-4248-b568-b9e3f065fda5
                  input: Hello
              converseAsyncRequestInferenceExample:
                description: Example using inference_id (mutually exclusive with connector_id)
                value:
                  agent_id: elastic-ai-agent
                  inference_id: my-inference-endpoint-id
                  input: Hello
      responses:
        '200':
          description: Indicates a successful response
          content:
            text/event-stream:
              examples:
                converseAsyncResponseExample:
                  description: Example stream containing the chain of events representing a conversation with the agent
                  value:
                    - data:
                        data:
                          conversation_id: c250305b-1929-4248-b568-b9e3f065fda5
                      event: conversation_id_set
                    - data:
                        data:
                          reasoning: Starting with a general search to understand what content is available.
                      event: reasoning
                    - data:
                        data:
                          params:
                            query: latest documents
                          tool_call_id: tooluse__2aJELgyRYqD8SDOKSiwtg
                          tool_id: platform.core.search
                      event: tool_call
                    - data:
                        data:
                          results:
                            - data:
                                message: Could not figure out which index to use
                              type: error
                          tool_call_id: tooluse__2aJELgyRYqD8SDOKSiwtg
                      event: tool_result
                    - data:
                        data:
                          round:
                            id: a5692d54-bc06-4a6e-aea1-412779c73f66
                            input:
                              message: Hello
                            response:
                              message: Hello! How can I help you today?
                      event: round_complete
                    - data:
                        data:
                          access_control:
                            access_mode: private
                          conversation_id: c250305b-1929-4248-b568-b9e3f065fda5
                          title: Hello
                      event: conversation_created
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/agent_builder/converse/async\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"input\": \"Hello again let us have an async chat\",\n    \"agent_id\": \"elastic-ai-agent\",\n    \"conversation_id\": \"<CONVERSATION_ID>\"\n  }'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/converse/async\n{\n  \"input\": \"Hello again let's have an async chat\",\n  \"agent_id\": \"elastic-ai-agent\",\n  \"conversation_id\": \"<CONVERSATION_ID>\"\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/mcp:
    post:
      tags:
        - agent builder
      summary: MCP server
      description: "> warn\n> This endpoint is designed for MCP clients (Claude Desktop, Cursor, VS Code, etc.) and should not be used directly via REST APIs. Use MCP Inspector or native MCP clients instead.\nTo learn more about the Agent Builder MCP server, refer to the [MCP documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/mcp-server).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read."
      operationId: post-agent-builder-mcp
      parameters:
        - name: namespace
          in: query
          description: Comma-separated list of namespaces to filter tools. Only tools matching the specified namespaces will be returned.
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema: { }
            examples:
              mcpInitializeRequestExample:
                description: 'WARNING: DO NOT USE THIS ENDPOINT VIA REST API. These examples are auto-generated and should not be run. Integrate with MCP using MCP Inspector or native MCP clients (Claude Desktop, Cursor, VS Code) instead.'
                value:
                  id: 1
                  jsonrpc: '2.0'
                  method: initialize
                  params:
                    capabilities: { }
                    clientInfo:
                      name: test-client
                      version: 1.0.0
                    protocolVersion: '2024-11-05'
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                mcpInitializeResponseExample:
                  description: Example response showing the successful result of communication initialisation over MCP protocol
                  value:
                    id: 1
                    jsonrpc: '2.0'
                    result:
                      capabilities:
                        tools:
                          listChanged: true
                      protocolVersion: '2024-11-05'
                      serverInfo:
                        name: elastic-mcp-server
                        version: 0.0.1
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/plugins:
    get:
      tags:
        - agent builder
      summary: List plugins
      description: 'List all installed plugins and their managed assets. Plugins are installable packages that bundle agent capabilities such as skills, following the [Claude agent plugin specification](https://code.claude.com/docs/en/plugins). To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-plugins
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                listPluginsResponseExample:
                  description: Example response that returns one installed plugin
                  value:
                    results:
                      - created_at: '2025-01-01T00:00:00.000Z'
                        description: Financial analysis tools and skills for Claude
                        id: financial-analysis
                        manifest:
                          author:
                            name: Anthropic
                            url: https://www.anthropic.com
                          keywords:
                            - finance
                            - analysis
                          repository: https://github.com/anthropics/financial-services-plugins
                        name: financial-analysis
                        skill_ids:
                          - financial-analysis-analyze-portfolio
                        source_url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
                        unmanaged_assets:
                          agents: [ ]
                          hooks: [ ]
                          lsp_servers: [ ]
                          mcp_servers: [ ]
                          output_styles: [ ]
                        updated_at: '2025-01-01T00:00:00.000Z'
                        version: 1.0.0
      x-codeSamples:
        - lang: curl
          source: "curl \\\n -X GET \"${KIBANA_URL}/api/agent_builder/plugins\" \\\n -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/plugins\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/plugins/{pluginId}':
    delete:
      tags:
        - agent builder
      summary: Delete a plugin
      description: 'Delete an installed plugin by ID. This action cannot be undone. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:write.'
      operationId: delete-agent-builder-plugins-pluginid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pluginId
          in: path
          description: The unique identifier of the plugin.
          required: true
          schema:
            type: string
        - name: force
          in: query
          description: 'If true, removes the plugin skills from agents that use them and then deletes the plugin. If false and any agent uses the plugin skills, the request returns 409 Conflict with the list of agents.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                deletePluginResponseExample:
                  description: Example response showing that deletion of the plugin has been successful
                  value:
                    success: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/agent_builder/plugins/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/agent_builder/plugins/{id}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - agent builder
      summary: Get a plugin by id
      description: 'Get a specific plugin by ID. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-plugins-pluginid
      parameters:
        - name: pluginId
          in: path
          description: The unique identifier of the plugin.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getPluginByIdResponseExample:
                  description: Example response returning a single installed plugin
                  value:
                    created_at: '2025-01-01T00:00:00.000Z'
                    description: Financial analysis tools and skills for Claude
                    id: financial-analysis
                    manifest:
                      author:
                        name: Anthropic
                        url: https://www.anthropic.com
                      keywords:
                        - finance
                        - analysis
                      repository: https://github.com/anthropics/financial-services-plugins
                    name: financial-analysis
                    skill_ids:
                      - financial-analysis-analyze-portfolio
                    source_url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
                    unmanaged_assets:
                      agents: [ ]
                      hooks: [ ]
                      lsp_servers: [ ]
                      mcp_servers: [ ]
                      output_styles: [ ]
                    updated_at: '2025-01-01T00:00:00.000Z'
                    version: 1.0.0
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/agent_builder/plugins/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/agent_builder/plugins/{id}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/plugins/install:
    post:
      tags:
        - agent builder
      summary: Install a plugin
      description: 'Install a plugin from a [GitHub Claude plugin URL](https://code.claude.com/docs/en/plugins) or a direct ZIP URL. Plugins bundle agent capabilities such as skills. To learn more about Agent Builder plugins, refer to the [plugins documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/plugins).<br/><br/>[Required authorization] Route required privileges: agentBuilder:write.'
      operationId: post-agent-builder-plugins-install
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - url
              type: object
              properties:
                plugin_name:
                  type: string
                  description: Optional name override for the plugin. Defaults to the manifest name.
                url:
                  type: string
                  description: URL to install the plugin from (GitHub URL or direct zip URL).
              additionalProperties: false
            examples:
              installPluginFromGithubExample:
                description: Example request for installing a plugin from a GitHub URL
                value:
                  url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
              installPluginFromZipExample:
                description: Example request for installing a plugin from a direct zip URL
                value:
                  url: https://my-server.example.com/my-plugin.zip
              installPluginWithNameOverrideExample:
                description: Example request for installing a plugin with a custom name
                value:
                  plugin_name: my-custom-plugin-name
                  url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                installPluginResponseExample:
                  description: Example response returning the definition of the installed plugin
                  value:
                    created_at: '2025-01-01T00:00:00.000Z'
                    description: Financial analysis tools and skills for Claude
                    id: financial-analysis
                    manifest:
                      author:
                        name: Anthropic
                        url: https://www.anthropic.com
                      keywords:
                        - finance
                        - analysis
                      repository: https://github.com/anthropics/financial-services-plugins
                    name: financial-analysis
                    skill_ids:
                      - financial-analysis-analyze-portfolio
                    source_url: https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis
                    unmanaged_assets:
                      agents: [ ]
                      hooks: [ ]
                      lsp_servers: [ ]
                      mcp_servers: [ ]
                      output_styles: [ ]
                    updated_at: '2025-01-01T00:00:00.000Z'
                    version: 1.0.0
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/agent_builder/plugins/install\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"url\": \"https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis\"\n}'\n"
        - lang: Console
          source: "POST kbn://api/agent_builder/plugins/install\n{\n  \"url\": \"https://github.com/anthropics/financial-services-plugins/tree/main/financial-analysis\"\n}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/skills:
    get:
      tags:
        - agent builder
      summary: List skills
      description: 'List all available skills (built-in and user-created). To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-skills
      parameters:
        - name: include_plugins
          in: query
          description: Set to true to include skills from plugins.
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                listSkillsResponseExample:
                  description: Example response returning a list of skills
                  value:
                    results:
                      - description: A built-in skill provided by the platform.
                        experimental: false
                        id: built-in-skill-id
                        name: Built-in Skill
                        readonly: true
                        referenced_content_count: 0
                      - description: A user-created skill for data analysis.
                        experimental: false
                        id: custom-skill-id
                        name: Custom Skill
                        readonly: false
                        referenced_content_count: 1
                        tool_ids:
                          - platform.core.search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"https://${KIBANA_URL}/api/agent_builder/skills\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn:/api/agent_builder/skills\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - agent builder
      summary: Create a skill
      description: 'Create a new user-defined skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageSkills.'
      operationId: post-agent-builder-skills
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - id
                - name
                - description
                - content
              type: object
              properties:
                content:
                  type: string
                  description: Skill instructions content (markdown).
                description:
                  type: string
                  description: Description of what the skill does.
                id:
                  type: string
                  description: Unique identifier for the skill.
                name:
                  type: string
                  description: Human-readable name for the skill.
                referenced_content:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - name
                      - relativePath
                      - content
                    type: object
                    properties:
                      content:
                        type: string
                        description: Content of the reference.
                      name:
                        type: string
                        description: Name of the referenced content.
                      relativePath:
                        type: string
                        description: Relative path of the referenced content.
                    additionalProperties: false
                tool_ids:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                    description: Tool ID from the tool registry.
                  description: Tool IDs from the tool registry that this skill references.
                  default: [ ]
              additionalProperties: false
            examples:
              createSkillRequestExample:
                description: Example request to create a user-defined skill
                value:
                  content: You are an expert data analyst. Use the available tools to query and analyze data.
                  description: A skill for performing custom data analysis.
                  id: my-custom-skill
                  name: Custom Analysis Skill
                  tool_ids:
                    - platform.core.search
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                createSkillResponseExample:
                  description: Example response returning the created skill
                  value:
                    content: You are an expert data analyst. Use the available tools to query and analyze data.
                    description: A skill for performing custom data analysis.
                    experimental: false
                    id: my-custom-skill
                    name: Custom Analysis Skill
                    readonly: false
                    tool_ids:
                      - platform.core.search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"https://${KIBANA_URL}/api/agent_builder/skills\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"id\": \"my-custom-skill\",\n    \"name\": \"Custom Analysis Skill\",\n    \"description\": \"A skill for performing custom data analysis.\",\n    \"content\": \"You are an expert data analyst.\",\n    \"tool_ids\": [\"platform.core.search\"]\n  }'\n"
        - lang: Console
          source: "POST kbn:/api/agent_builder/skills\n{\n  \"id\": \"my-custom-skill\",\n  \"name\": \"Custom Analysis Skill\",\n  \"description\": \"A skill for performing custom data analysis.\",\n  \"content\": \"You are an expert data analyst.\",\n  \"tool_ids\": [\"platform.core.search\"]\n}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/skills/{skillId}':
    delete:
      tags:
        - agent builder
      summary: Delete a skill
      description: 'Delete a user-created skill by ID. If agents still reference the skill, the request returns 409 unless force=true, which removes the skill from agents first. Built-in skills cannot be deleted. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageSkills.'
      operationId: delete-agent-builder-skills-skillid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: skillId
          in: path
          description: The unique identifier of the skill.
          required: true
          schema:
            maxLength: 512
            minLength: 1
            type: string
        - name: force
          in: query
          description: 'If true, removes the skill from agents that use it and then deletes it. If false and any agent uses the skill, the request returns 409 Conflict with the list of agents.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                deleteSkillResponseExample:
                  description: Example response showing that the deletion operation was successful
                  value:
                    success: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"https://${KIBANA_URL}/api/agent_builder/skills/{skillId}?force=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn:/api/agent_builder/skills/{skillId}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - agent builder
      summary: Get a skill by id
      description: 'Get a specific skill by ID. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-skills-skillid
      parameters:
        - name: skillId
          in: path
          description: The unique identifier of the skill.
          required: true
          schema:
            maxLength: 512
            minLength: 1
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getSkillResponseExample:
                  description: Example response returning a skill by ID
                  value:
                    content: You are an expert data analyst. Use the available tools to query and analyze data.
                    description: A skill for performing custom data analysis.
                    experimental: false
                    id: my-custom-skill
                    name: Custom Analysis Skill
                    readonly: false
                    tool_ids:
                      - platform.core.search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"https://${KIBANA_URL}/api/agent_builder/skills/{skillId}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn:/api/agent_builder/skills/{skillId}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - agent builder
      summary: Update a skill
      description: 'Update an existing user-created skill. To learn more about Agent Builder skills, refer to the [skills documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/skills).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageSkills.'
      operationId: put-agent-builder-skills-skillid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: skillId
          in: path
          description: The unique identifier of the skill.
          required: true
          schema:
            maxLength: 512
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                content:
                  type: string
                  description: Updated skill instructions content.
                description:
                  type: string
                  description: Updated description.
                name:
                  type: string
                  description: Updated name for the skill.
                referenced_content:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - name
                      - relativePath
                      - content
                    type: object
                    properties:
                      content:
                        type: string
                        description: Content of the reference.
                      name:
                        type: string
                        description: Name of the referenced content.
                      relativePath:
                        type: string
                        description: Relative path of the referenced content.
                    additionalProperties: false
                tool_ids:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                    description: Updated tool ID.
                  description: Updated tool IDs from the tool registry.
              additionalProperties: false
            examples:
              updateSkillRequestExample:
                description: Example request to update a user-defined skill
                value:
                  content: Updated skill instructions content.
                  description: Updated description for the skill.
                  name: Updated Skill Name
                  tool_ids:
                    - platform.core.search
                    - platform.core.execute_esql
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateSkillResponseExample:
                  description: Example response returning the updated skill
                  value:
                    content: Updated skill instructions content.
                    description: Updated description for the skill.
                    experimental: false
                    id: my-custom-skill
                    name: Updated Skill Name
                    readonly: false
                    tool_ids:
                      - platform.core.search
                      - platform.core.execute_esql
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"https://${KIBANA_URL}/api/agent_builder/skills/{skillId}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\": \"Updated Skill Name\",\n    \"description\": \"Updated description for the skill.\"\n  }'\n"
        - lang: Console
          source: "PUT kbn:/api/agent_builder/skills/{skillId}\n{\n  \"name\": \"Updated Skill Name\",\n  \"description\": \"Updated description for the skill.\"\n}\n"
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/tools:
    get:
      tags:
        - agent builder
      summary: List tools
      description: 'List all available tools. Use this endpoint to retrieve complete tool definitions including their schemas and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-tools
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                listToolsResponseExample:
                  description: Example response returning a list of existing tools
                  value:
                    results:
                      - configuration: { }
                        description: "A powerful tool for searching and analyzing data within your Elasticsearch cluster.\nIt supports both full-text relevance searches and structured analytical queries.\n\nUse this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.\n\nExamples of queries:\n- \"find articles about serverless architecture\"\n- \"search for support tickets mentioning 'billing issue' or 'refund request'\"\n- \"what is our policy on parental leave?\"\n- \"list all products where the category is 'electronics'\"\n- \"show me the last 5 documents from that index\"\n- \"show me the sales over the last year break down by month\"\n\nNote:\n- The 'index' parameter can be used to specify which index to search against.\n If not provided, the tool will decide itself which is the best index to use.\n- It is perfectly fine not to specify the 'index' parameter. It should only be specified when you already\n know about the index and fields you want to search on, e.g. if the user explicitly specified it."
                        id: platform.core.search
                        readonly: true
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            index:
                              description: '(optional) Index to search against. If not provided, will automatically select the best index to use based on the query.'
                              type: string
                            query:
                              description: A natural language query expressing the search request
                              type: string
                          required:
                            - query
                        tags: [ ]
                        type: builtin
                      - configuration: { }
                        description: Retrieve the full content (source) of an Elasticsearch document based on its ID and index name.
                        id: platform.core.get_document_by_id
                        readonly: true
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            id:
                              description: ID of the document to retrieve
                              type: string
                            index:
                              description: Name of the index to retrieve the document from
                              type: string
                          required:
                            - id
                            - index
                        tags: [ ]
                        type: builtin
                      - configuration: { }
                        description: "Execute an ES|QL query and return the results in a tabular format.\n\n**IMPORTANT**: This tool only **runs** queries; it does not write them.\nThink of this as the final step after a query has been prepared.\n\nYou **must** get the query from one of two sources before calling this tool:\n1.  The output of the `platform.core.generate_esql` tool (if the tool is available).\n2.  A verbatim query provided directly by the user.\n\nUnder no circumstances should you invent, guess, or modify a query yourself for this tool.\nIf you need a query, use the `platform.core.generate_esql` tool first."
                        id: platform.core.execute_esql
                        readonly: true
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            query:
                              description: The ES|QL query to execute
                              type: string
                          required:
                            - query
                        tags: [ ]
                        type: builtin
                      - configuration:
                          params:
                            limit:
                              description: Maximum number of results to return
                              type: integer
                            startTime:
                              description: Start time for the analysis in ISO format
                              type: date
                          query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                        description: Example ES|QL query tool for analyzing financial trades with time filtering
                        id: example-esql-tool
                        readonly: false
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          description: Parameters needed to execute the query
                          type: object
                          properties:
                            limit:
                              description: Maximum number of results to return
                              type: integer
                            startTime:
                              description: Start time for the analysis in ISO format
                              format: date-time
                              type: string
                          required:
                            - startTime
                            - limit
                        tags:
                          - analytics
                          - finance
                        type: esql
                      - configuration:
                          pattern: financial_*
                        description: Search tool specifically for financial data analysis and reporting
                        id: example-index-search-tool
                        readonly: false
                        schema:
                          $schema: http://json-schema.org/draft-07/schema#
                          additionalProperties: false
                          type: object
                          properties:
                            nlQuery:
                              description: A natural language query expressing the search request
                              type: string
                          required:
                            - nlQuery
                        tags:
                          - search
                          - finance
                        type: index_search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"https://${KIBANA_URL}/api/agent_builder/tools\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn:/api/agent_builder/tools\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - agent builder
      summary: Create a tool
      description: 'Create a new tool. Use this endpoint to define a custom tool with specific functionality and configuration for use by agents. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageTools.'
      operationId: post-agent-builder-tools
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - id
                - type
                - configuration
              type: object
              properties:
                configuration:
                  type: object
                  additionalProperties: { }
                  description: Tool-specific configuration parameters. See examples for details.
                confirmation:
                  type: object
                  properties:
                    askUser:
                      enum:
                        - once
                        - always
                        - never
                      type: string
                  additionalProperties: false
                  description: Optional tool call policy to control tool call confirmation behavior
                description:
                  type: string
                  description: Description of what the tool does.
                  default: ''
                id:
                  type: string
                  description: Unique identifier for the tool.
                tags:
                  type: array
                  items:
                    type: string
                    description: Tag for categorizing the tool.
                  description: Optional tags for categorizing and organizing tools.
                  default: [ ]
                type:
                  enum:
                    - esql
                    - index_search
                    - workflow
                    - mcp
                  type: string
                  description: 'The type of tool to create (e.g., esql, index_search).'
              additionalProperties: false
            examples:
              createEsqlToolRequest:
                description: Example request to create an ESQL query tool with a pre-defined query
                value:
                  configuration:
                    params:
                      limit:
                        description: Maximum number of results to return
                        type: integer
                      startTime:
                        description: Start time for the analysis in ISO format
                        type: date
                    query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                  description: Example ES|QL query tool for analyzing financial trades with time filtering
                  id: example-esql-tool
                  tags:
                    - analytics
                    - finance
                  type: esql
              createIndexSearchToolRequest:
                description: Example request to create an index_search tool with a pre-defined index pattern
                value:
                  configuration:
                    pattern: financial_*
                  description: Search tool specifically for financial data analysis and reporting
                  id: example-index-search-tool
                  tags:
                    - search
                    - finance
                  type: index_search
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                createEsqlToolExample:
                  description: Example response returning a definition of ESQL tool created
                  value:
                    configuration:
                      params:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          type: date
                      query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                    description: Example ES|QL query tool for analyzing financial trades with time filtering
                    id: example-esql-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      description: Parameters needed to execute the query
                      type: object
                      properties:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          format: date-time
                          type: string
                      required:
                        - startTime
                        - limit
                    tags:
                      - analytics
                      - finance
                    type: esql
                createIndexSearchToolExample:
                  description: Example response returning a definition of search tool tool created
                  value:
                    configuration:
                      pattern: financial_*
                    description: Search tool specifically for financial data analysis and reporting
                    id: example-index-search-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        nlQuery:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - nlQuery
                    tags:
                      - search
                      - finance
                    type: index_search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n -X POST \"https://${KIBANA_URL}/api/agent_builder/tools\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n   \"id\": \"example-esql-tool\",\n   \"type\": \"esql\",\n   \"description\": \"Example ES|QL query tool for analyzing financial trades with time filtering\",\n   \"tags\": [\"analytics\", \"finance\"],\n   \"configuration\": {\n     \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n     \"params\": {\n       \"startTime\": {\n         \"type\": \"date\",\n         \"description\": \"Start time for the analysis in ISO format\"\n       },\n       \"limit\": {\n         \"type\": \"integer\",\n         \"description\": \"Maximum number of results to return\"\n       }\n     }\n   }\n }'\n"
        - lang: Console
          source: "POST kbn:/api/agent_builder/tools\n{\n  \"id\": \"example-esql-tool\",\n  \"type\": \"esql\",\n  \"description\": \"An ES|QL query tool for analyzing financial trades with time filtering\",\n  \"tags\": [\"analytics\", \"finance\", \"updated\"],\n  \"configuration\": {\n    \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n    \"params\": {\n      \"startTime\": {\n        \"type\": \"date\",\n        \"description\": \"Start time for the analysis in ISO format\"\n      },\n      \"limit\": {\n        \"type\": \"integer\",\n        \"description\": \"Maximum number of results to return\"\n      }\n    }\n  }\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/agent_builder/tools/_execute:
    post:
      tags:
        - agent builder
      summary: Run a tool
      description: 'Run a tool with parameters. Use this endpoint to run a tool directly with specified inputs and optional external connector integration. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: post-agent-builder-tools-execute
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - tool_id
                - tool_params
              type: object
              properties:
                approvals:
                  type: object
                  properties:
                    auto_approved_apis:
                      type: object
                      properties:
                        elasticsearch:
                          maxItems: 100
                          type: array
                          items:
                            maxLength: 256
                            type: string
                          description: 'Elasticsearch APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `indices.create`), a namespace wildcard (for example `indices.*`), or `*` for every Elasticsearch API.'
                        kibana:
                          maxItems: 100
                          type: array
                          items:
                            maxLength: 256
                            type: string
                          description: 'Kibana APIs pre-approved for this run. Each entry is an exact identifier formed from the namespace and name (for example `alerting.delete-alerting-rule-id`), a namespace wildcard (for example `alerting.*`), or `*` for every Kibana API.'
                      additionalProperties: false
                      description: 'Destructive Elasticsearch or Kibana APIs the tool may call without a user confirmation, keyed by backend. A tool run has no live user to answer the confirmation prompt, so a destructive API is refused unless it is listed here.'
                  additionalProperties: false
                  description: Actions the tool run may take that would otherwise need a live user to approve them. Applies to this run and any sub-agents it spawns.
                connector_id:
                  type: string
                  description: Optional connector ID for tools that require external integrations.
                tool_id:
                  type: string
                  description: The ID of the tool to execute.
                tool_params:
                  type: object
                  additionalProperties: { }
                  description: Parameters to pass to the tool execution. See examples for details
              additionalProperties: false
            examples:
              executeBuiltinEsqlToolRequest:
                description: Example request executing platform.core.execute_esql tool
                value:
                  tool_id: platform.core.execute_esql
                  tool_params:
                    query: FROM financial_trades | LIMIT 3
              executeBuiltinToolRequest:
                description: Example request executing platform.core.get_document_by_id tool
                value:
                  tool_id: platform.core.get_document_by_id
                  tool_params:
                    id: TRD-20250805-0820a89f
                    index: financial_trades
              executeCustomEsqlToolRequest:
                description: Example request executing custom example-esql-tool tool
                value:
                  tool_id: example-esql-tool
                  tool_params:
                    limit: 3
                    startTime: '2024-01-01T00:00:00Z'
              executeIndexSearchToolRequest:
                description: Example request executing custom example-index-search-tool tool
                value:
                  tool_id: example-index-search-tool
                  tool_params:
                    nlQuery: find trades with high execution prices above 100
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                executeBuiltinEsqlToolExample:
                  description: Example response calling built-in platform.core.execute_esql tool
                  value:
                    results:
                      - data:
                          esql: FROM financial_trades | LIMIT 3
                        type: query
                      - data:
                          columns:
                            - name: account_id
                              type: keyword
                            - name: execution_price
                              type: double
                            - name: symbol
                              type: keyword
                            - name: trade_type
                              type: keyword
                          query: FROM financial_trades | LIMIT 3
                          source: esql
                          values:
                            - 
                              - ACC00179-1f91
                              - 43.77000045776367
                              - CVX
                              - sell
                            - 
                              - ACC00407-0bbb
                              - 660.4199829101562
                              - V
                              - buy
                            - 
                              - ACC00179-1f91
                              - 440.3599853515625
                              - KO
                              - buy
                        tool_result_id: xTpT
                        type: esql_results
                executeBuiltinToolExample:
                  description: Example response calling built-in platform.core.get_document_by_id tool
                  value:
                    results:
                      - data:
                          content:
                            account_id: ACC00271-fb5c
                            execution_price: 488.54
                            execution_timestamp: '2025-08-05T08:04:11.649855'
                            last_updated: '2025-09-15T13:23:36'
                            order_status: executed
                            order_type: market
                            quantity: 131
                            status_reason: fully_filled
                            symbol: EWL
                            trade_cost: 63998.74
                            trade_id: TRD-20250805-0820a89f
                            trade_type: sell
                          partial: false
                          reference:
                            id: TRD-20250805-0820a89f
                            index: financial_trades
                        type: resource
                executeCustomEsqlToolExample:
                  description: Example response calling custom example-esql-tool tool
                  value:
                    results:
                      - data:
                          columns:
                            - name: trade_count
                              type: long
                            - name: avg_price
                              type: double
                            - name: symbol
                              type: keyword
                          query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                          source: esql
                          values:
                            - 
                              - 2115
                              - 89.33911587329621
                              - US_T_BOND_20YR
                            - 
                              - 2112
                              - 104.20854155945055
                              - INTL_CORP_ASIA_D
                            - 
                              - 2105
                              - 89.93244177666526
                              - INTL_CORP_EU_B
                        tool_result_id: Voy8
                        type: esql_results
                executeIndexSearchToolExample:
                  description: Example response calling custom example-index-search-tool tool
                  value:
                    results:
                      - data:
                          esql: "FROM financial_trades\n| WHERE execution_price > 100\n| LIMIT 100"
                        type: query
                      - data:
                          columns:
                            - name: account_id
                              type: keyword
                            - name: execution_price
                              type: double
                            - name: execution_timestamp
                              type: date
                            - name: symbol
                              type: keyword
                            - name: trade_type
                              type: keyword
                          query: "FROM financial_trades\n| WHERE execution_price > 100\n| LIMIT 100"
                          source: esql
                          values:
                            - 
                              - ACC00407-0bbb
                              - 660.4199829101562
                              - '2020-09-25T11:06:08.687Z'
                              - V
                              - buy
                            - 
                              - ACC00179-1f91
                              - 440.3599853515625
                              - '2025-08-07T21:56:45.377Z'
                              - KO
                              - buy
                            - 
                              - ACC00407-0bbb
                              - 132.8800048828125
                              - '2020-11-19T04:39:13.655Z'
                              - JAP_JGB_10YR
                              - sell
                        tool_result_id: uE8y
                        type: esql_results
      x-codeSamples:
        - lang: curl
          source: "curl \\\n -X POST \"https://${KIBANA_URL}/api/agent_builder/tools/_execute\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n   \"tool_id\": \"platform.core.search\",\n   \"tool_params\": {\n     \"query\": \"can you find john doe's email from the employee index?\"}\n   }\n }'\n"
        - lang: Console
          source: "POST kbn:/api/agent_builder/tools/_execute\n{\n  \"tool_id\": \"platform.core.search\",\n  \"tool_params\": {\n    \"query\": \"can you find john doe's email from the employee index?\"\n  }\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/agent_builder/tools/{toolId}':
    delete:
      tags:
        - agent builder
      summary: Delete a tool
      description: 'Delete a tool by ID. This action cannot be undone. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageTools.'
      operationId: delete-agent-builder-tools-toolid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: toolId
          in: path
          description: The unique identifier of the tool to delete.
          required: true
          schema:
            type: string
        - name: force
          in: query
          description: 'If true, removes the tool from agents that use it and then deletes it. If false and any agent uses the tool, the request returns 409 Conflict with the list of agents.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                deleteAgentResponseExample:
                  description: Example response showing that the deletion operation was successful
                  value:
                    success: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"https://${KIBANA_URL}/api/agent_builder/tools/{toolId}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn:/api/agent_builder/tools/{toolId}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - agent builder
      summary: Get a tool by id
      description: 'Get a specific tool by ID. Use this endpoint to retrieve the complete tool definition including its schema and configuration requirements. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:read.'
      operationId: get-agent-builder-tools-toolid
      parameters:
        - name: toolId
          in: path
          description: The unique identifier of the tool to retrieve.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getBuiltinToolExample:
                  description: Example response returning built-in platform.core.search tool
                  value:
                    configuration: { }
                    description: "A powerful tool for searching and analyzing data within your Elasticsearch cluster.\nIt supports both full-text relevance searches and structured analytical queries.\n\nUse this tool for any query that involves finding documents, counting, aggregating, or summarizing data from a known index.\n\nExamples of queries:\n- \"find articles about serverless architecture\"\n- \"search for support tickets mentioning 'billing issue' or 'refund request'\"\n- \"what is our policy on parental leave?\"\n- \"list all products where the category is 'electronics'\"\n- \"show me the last 5 documents from that index\"\n- \"show me the sales over the last year break down by month\"\n\nNote:\n- The 'index' parameter can be used to specify which index to search against.\n If not provided, the tool will decide itself which is the best index to use.\n- It is perfectly fine not to specify the 'index' parameter. It should only be specified when you already\n know about the index and fields you want to search on, e.g. if the user explicitly specified it."
                    id: platform.core.search
                    readonly: true
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        index:
                          description: '(optional) Index to search against. If not provided, will automatically select the best index to use based on the query.'
                          type: string
                        query:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - query
                    tags: [ ]
                    type: builtin
                getEsqlToolExample:
                  description: Example response returning custom example-esql-tool tool
                  value:
                    configuration:
                      params:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          type: date
                      query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                    description: Example ES|QL query tool for analyzing financial trades with time filtering
                    id: example-esql-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      description: Parameters needed to execute the query
                      type: object
                      properties:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          format: date-time
                          type: string
                      required:
                        - startTime
                        - limit
                    tags:
                      - analytics
                      - finance
                    type: esql
                getIndexSearchToolExample:
                  description: Example response returning custom example-index-search-tool tool
                  value:
                    configuration:
                      pattern: financial_*
                    description: Search tool specifically for financial data analysis and reporting
                    id: example-index-search-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        nlQuery:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - nlQuery
                    tags:
                      - search
                      - finance
                    type: index_search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"https://${KIBANA_URL}/api/agent_builder/tools/{toolId}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn:/api/agent_builder/tools/{toolId}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - agent builder
      summary: Update a tool
      description: 'Update an existing tool. Use this endpoint to modify any aspect of the tool''s configuration or metadata. To learn more about Agent Builder tools, refer to the [tools documentation](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/tools).<br/><br/>[Required authorization] Route required privileges: agentBuilder:manageTools.'
      operationId: put-agent-builder-tools-toolid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: toolId
          in: path
          description: The unique identifier of the tool to update.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                configuration:
                  type: object
                  additionalProperties: { }
                  description: Updated tool-specific configuration parameters. See examples for details.
                confirmation:
                  type: object
                  properties:
                    askUser:
                      enum:
                        - once
                        - always
                        - never
                      type: string
                  additionalProperties: false
                  description: Updated tool call policy to control tool call confirmation behavior
                description:
                  type: string
                  description: Updated description of what the tool does.
                tags:
                  type: array
                  items:
                    type: string
                    description: Updated tag for categorizing the tool.
                  description: Updated tags for categorizing and organizing tools.
              additionalProperties: false
            examples:
              updateEsqlToolRequest:
                description: Example request to update the custom ESQL tool
                value:
                  configuration:
                    params:
                      limit:
                        description: Maximum number of results to return
                        type: integer
                      startTime:
                        description: Start time for the analysis in ISO format
                        type: date
                      symbolPattern:
                        description: 'Pattern to filter symbols (e.g., ''US_*'' for US instruments)'
                        type: keyword
                    query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime AND symbol LIKE ?symbolPattern | STATS trade_count=COUNT(*), avg_price=AVG(execution_price), total_volume=SUM(quantity) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                  description: Updated ES|QL query tool for comprehensive financial analysis with enhanced filtering
                  tags:
                    - analytics
                    - finance
                    - reporting
              updateIndexSearchToolRequest:
                description: Example request to update the custom Search tool
                value:
                  description: 'Updated search tool for comprehensive financial data analysis, reporting, and compliance monitoring'
                  tags:
                    - search
                    - finance
                    - compliance
                    - reporting
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateEsqlToolExample:
                  description: Example response showing the updated ESQL tool
                  value:
                    configuration:
                      params:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          type: date
                        symbolPattern:
                          description: 'Pattern to filter symbols (e.g., ''US_*'' for US instruments)'
                          type: keyword
                      query: 'FROM financial_trades | WHERE execution_timestamp >= ?startTime AND symbol LIKE ?symbolPattern | STATS trade_count=COUNT(*), avg_price=AVG(execution_price), total_volume=SUM(quantity) BY symbol | SORT trade_count DESC | LIMIT ?limit'
                    description: Updated ES|QL query tool for comprehensive financial analysis with enhanced filtering
                    id: example-esql-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      description: Parameters needed to execute the enhanced query
                      type: object
                      properties:
                        limit:
                          description: Maximum number of results to return
                          type: integer
                        startTime:
                          description: Start time for the analysis in ISO format
                          format: date-time
                          type: string
                        symbolPattern:
                          description: 'Pattern to filter symbols (e.g., ''US_*'' for US instruments)'
                          type: string
                      required:
                        - startTime
                        - symbolPattern
                        - limit
                    tags:
                      - analytics
                      - finance
                      - reporting
                    type: esql
                updateIndexSearchToolExample:
                  description: Example response showing the updated Search tool
                  value:
                    configuration:
                      pattern: financial_*
                    description: 'Updated search tool for comprehensive financial data analysis, reporting, and compliance monitoring'
                    id: example-index-search-tool
                    readonly: false
                    schema:
                      $schema: http://json-schema.org/draft-07/schema#
                      additionalProperties: false
                      type: object
                      properties:
                        nlQuery:
                          description: A natural language query expressing the search request
                          type: string
                      required:
                        - nlQuery
                    tags:
                      - search
                      - finance
                      - compliance
                      - reporting
                    type: index_search
      x-codeSamples:
        - lang: curl
          source: "curl \\\n -X PUT \"https://${KIBANA_URL}/api/agent_builder/tools/{toolId}\" \\\n -H \"Authorization: ApiKey ${API_KEY}\" \\\n -H \"kbn-xsrf: true\" \\\n -H \"Content-Type: application/json\" \\\n -d '{\n   \"description\": \"Updated ES|QL query tool for analyzing financial trades with time filtering\",\n   \"tags\": [\"analytics\", \"finance\", \"updated\"],\n   \"configuration\": {\n     \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n     \"params\": {\n       \"startTime\": {\n         \"type\": \"date\",\n         \"description\": \"Start time for the analysis in ISO format\"\n       },\n       \"limit\": {\n         \"type\": \"integer\",\n         \"description\": \"Maximum number of results to return\"\n       }\n     }\n   }\n }'\n"
        - lang: Console
          source: "PUT kbn:/api/agent_builder/tools/{toolId}\n{\n  \"description\": \"Updated ES|QL query tool for analyzing financial trades with time filtering\",\n  \"tags\": [\"analytics\", \"finance\", \"updated\"],\n  \"configuration\": {\n    \"query\": \"FROM financial_trades | WHERE execution_timestamp >= ?startTime | STATS trade_count=COUNT(*), avg_price=AVG(execution_price) BY symbol | SORT trade_count DESC | LIMIT ?limit\",\n    \"params\": {\n      \"startTime\": {\n        \"type\": \"date\",\n        \"description\": \"Start time for the analysis in ISO format\"\n      },\n      \"limit\": {\n        \"type\": \"integer\",\n        \"description\": \"Maximum number of results to return\"\n      }\n    }\n  }\n}\n"
      x-state: Added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/_health:
    get:
      tags:
        - alerting
      summary: Get the alerting framework health
      description: "You must have `read` privileges for the **Management > Stack Rules** feature or for at least one of the **Analytics > Discover**, **Analytics > Machine Learning**, **Observability**, or **Security** features.\n"
      operationId: getAlertingHealth
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  alerting_framework_health:
                    type: object
                    properties:
                      decryption_health:
                        type: object
                        properties:
                          status:
                            enum:
                              - error
                              - ok
                              - warn
                            type: string
                            example: ok
                          timestamp:
                            type: string
                            format: date-time
                            example: '2023-01-13T01:28:00.280Z'
                        description: The timestamp and status of the rule decryption.
                      execution_health:
                        type: object
                        properties:
                          status:
                            enum:
                              - error
                              - ok
                              - warn
                            type: string
                            example: ok
                          timestamp:
                            type: string
                            format: date-time
                            example: '2023-01-13T01:28:00.280Z'
                        description: The timestamp and status of the rule run.
                      read_health:
                        type: object
                        properties:
                          status:
                            enum:
                              - error
                              - ok
                              - warn
                            type: string
                            example: ok
                          timestamp:
                            type: string
                            format: date-time
                            example: '2023-01-13T01:28:00.280Z'
                        description: The timestamp and status of the rule reading events.
                    description: "Three substates identify the health of the alerting framework: `decryption_health`, `execution_health`, and `read_health`.\n"
                  has_permanent_encryption_key:
                    type: boolean
                    description: 'If `false`, the encrypted saved object plugin does not have a permanent encryption key.'
                    example: true
                  is_sufficiently_secure:
                    type: boolean
                    description: 'If `false`, security is enabled but TLS is not.'
                    example: true
              examples:
                getAlertingHealthResponse:
                  $ref: '#/components/examples/Alerting_get_health_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alerting_401_response'
              examples:
                healthUnauthorizedResponse:
                  $ref: '#/components/examples/Alerting_401_health_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rule_types:
    get:
      tags:
        - alerting
      summary: Get the rule types
      description: "If you have `read` privileges for one or more Kibana features, the API response contains information about the appropriate rule types. For example, there are rule types associated with the **Management > Stack Rules** feature, **Analytics > Discover** and **Machine Learning** features, **Observability** features, and **Security** features. To get rule types associated with the **Stack Monitoring** feature, use the `monitoring_user` built-in role.\n"
      operationId: getRuleTypes
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    action_groups:
                      type: array
                      items:
                        type: object
                        properties:
                          id:
                            type: string
                          name:
                            type: string
                      description: "An explicit list of groups for which the rule type can schedule actions, each with the action group's unique ID and human readable name. Rule actions validation uses this configuration to ensure that groups are valid.\n"
                    action_variables:
                      type: object
                      properties:
                        context:
                          type: array
                          items:
                            type: object
                            properties:
                              description:
                                type: string
                              name:
                                type: string
                              useWithTripleBracesInTemplates:
                                type: boolean
                        params:
                          type: array
                          items:
                            type: object
                            properties:
                              description:
                                type: string
                              name:
                                type: string
                        state:
                          type: array
                          items:
                            type: object
                            properties:
                              description:
                                type: string
                              name:
                                type: string
                      description: "A list of action variables that the rule type makes available via context and state in action parameter templates, and a short human readable description. When you create a rule in Kibana, it uses this information to prompt you for these variables in action parameter editors.\n"
                    alerts:
                      type: object
                      properties:
                        context:
                          enum:
                            - ml.anomaly-detection
                            - observability.apm
                            - observability.logs
                            - observability.metrics
                            - observability.slo
                            - observability.threshold
                            - observability.uptime
                            - security
                            - stack
                          type: string
                          description: "The namespace for this rule type.\n"
                        dynamic:
                          enum:
                            - 'false'
                            - runtime
                            - strict
                            - 'true'
                          type: string
                          description: Indicates whether new fields are added dynamically.
                        isSpaceAware:
                          type: boolean
                          description: "Indicates whether the alerts are space-aware. If true, space-specific alert indices are used.\n"
                        mappings:
                          type: object
                          properties:
                            fieldMap:
                              type: object
                              additionalProperties:
                                $ref: '#/components/schemas/Alerting_fieldmap_properties'
                              description: "Mapping information for each field supported in alerts as data documents for this rule type. For more information about mapping parameters, refer to the Elasticsearch documentation.\n"
                        secondaryAlias:
                          type: string
                          description: "A secondary alias. It is typically used to support the signals alias for detection rules.\n"
                        shouldWrite:
                          type: boolean
                          description: "Indicates whether the rule should write out alerts as data.\n"
                        useEcs:
                          type: boolean
                          description: "Indicates whether to include the ECS component template for the alerts.\n"
                        useLegacyAlerts:
                          type: boolean
                          description: "Indicates whether to include the legacy component template for the alerts.\n"
                          default: false
                      description: "Details for writing alerts as data documents for this rule type.\n"
                    authorized_consumers:
                      type: object
                      properties:
                        alerts:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        apm:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        discover:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        infrastructure:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        logs:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        ml:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        monitoring:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        siem:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        slo:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        stackAlerts:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                        uptime:
                          type: object
                          properties:
                            all:
                              type: boolean
                            read:
                              type: boolean
                      description: The list of the plugins IDs that have access to the rule type.
                    category:
                      enum:
                        - management
                        - observability
                        - securitySolution
                      type: string
                      description: 'The rule category, which is used by features such as category-specific maintenance windows.'
                    default_action_group_id:
                      type: string
                      description: The default identifier for the rule type group.
                    does_set_recovery_context:
                      type: boolean
                      description: Indicates whether the rule passes context variables to its recovery action.
                    enabled_in_license:
                      type: boolean
                      description: Indicates whether the rule type is enabled or disabled based on the subscription.
                    has_alerts_mappings:
                      type: boolean
                      description: Indicates whether the rule type has custom mappings for the alert data.
                    has_fields_for_a_a_d:
                      type: boolean
                    id:
                      type: string
                      description: The unique identifier for the rule type.
                    is_exportable:
                      type: boolean
                      description: Indicates whether the rule type is exportable in **Stack Management > Saved Objects**.
                    minimum_license_required:
                      type: string
                      description: The subscriptions required to use the rule type.
                      example: basic
                    name:
                      type: string
                      description: The descriptive name of the rule type.
                    producer:
                      type: string
                      description: An identifier for the application that produces this rule type.
                      example: stackAlerts
                    recovery_action_group:
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                      description: An action group to use when an alert goes from an active state to an inactive one.
                    rule_task_timeout:
                      type: string
                      example: 5m
              examples:
                getRuleTypesResponse:
                  $ref: '#/components/examples/Alerting_get_rule_types_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Alerting_401_response'
              examples:
                ruleTypesUnauthorizedResponse:
                  $ref: '#/components/examples/Alerting_401_rule_types_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}':
    delete:
      tags:
        - alerting
      summary: Delete a rule
      operationId: delete-alerting-rule-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - alerting
      summary: Get rule details
      operationId: get-alerting-rule-id
      parameters:
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
              examples:
                getRuleResponse:
                  summary: Get an index threshold rule
                  description: A response that contains information about an index threshold rule.
                  value:
                    actions: [ ]
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2022-12-05T23:40:33.132Z'
                    created_by: elastic
                    enabled: true
                    id: 3583a470-74f6-11ed-9801-35303b735aef
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: my alert
                    notify_when: onActionGroupChange
                    params:
                      aggField: sheet.version
                      aggType: avg
                      groupBy: top
                      index:
                        - test-index
                      termField: name.keyword
                      termSize: 6
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 0
                    rule_type_id: .index-threshold
                    schedule:
                      interval: 1m
                    tags:
                      - cpu
                    throttle: 'null'
                    updated_at: '2022-12-05T23:40:33.132Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - alerting
      summary: Create a rule
      operationId: post-alerting-rule-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The identifier for the rule. If it is omitted, an ID is randomly generated.'
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - oneOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_es-query-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_transform-health-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting'
                  discriminator:
                    propertyName: rule_type_id
                    mapping:
                      .es-query: '#/components/schemas/Kibana_HTTP_APIs_es-query-create-rule-body-alerting'
                      .geo-containment: '#/components/schemas/Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting'
                      .index-threshold: '#/components/schemas/Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting'
                      apm.anomaly: '#/components/schemas/Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting'
                      apm.error_rate: '#/components/schemas/Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting'
                      apm.transaction_duration: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting'
                      apm.transaction_error_rate: '#/components/schemas/Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting'
                      datasetQuality.degradedDocs: '#/components/schemas/Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting'
                      logs.alert.document.count: '#/components/schemas/Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting'
                      metrics.alert.inventory.threshold: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting'
                      metrics.alert.threshold: '#/components/schemas/Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting'
                      monitoring_alert_cluster_health: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting'
                      monitoring_alert_cpu_usage: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting'
                      monitoring_alert_disk_usage: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting'
                      monitoring_alert_elasticsearch_version_mismatch: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting'
                      monitoring_alert_jvm_memory_usage: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting'
                      monitoring_alert_kibana_version_mismatch: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting'
                      monitoring_alert_license_expiration: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting'
                      monitoring_alert_logstash_version_mismatch: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting'
                      monitoring_alert_missing_monitoring_data: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting'
                      monitoring_alert_nodes_changed: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting'
                      monitoring_alert_thread_pool_search_rejections: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting'
                      monitoring_alert_thread_pool_write_rejections: '#/components/schemas/Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting'
                      monitoring_ccr_read_exceptions: '#/components/schemas/Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting'
                      monitoring_shard_size: '#/components/schemas/Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting'
                      observability.rules.custom_threshold: '#/components/schemas/Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting'
                      slo.rules.burnRate: '#/components/schemas/Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting'
                      transform_health: '#/components/schemas/Kibana_HTTP_APIs_transform-health-create-rule-body-alerting'
                      xpack.ml.anomaly_detection_alert: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting'
                      xpack.ml.anomaly_detection_jobs_health: '#/components/schemas/Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting'
                      xpack.synthetics.alerts.monitorStatus: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting'
                      xpack.synthetics.alerts.tls: '#/components/schemas/Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting'
                      xpack.uptime.alerts.durationAnomaly: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting'
                      xpack.uptime.alerts.monitorStatus: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting'
                      xpack.uptime.alerts.tlsCertificate: '#/components/schemas/Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule'
            examples:
              createEsQueryEsqlRuleRequest:
                summary: Elasticsearch query rule (ES|QL)
                description: "Create an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL) to define its query and a server log connector to send notifications.\n"
                value:
                  actions:
                    - frequency:
                        notify_when: onActiveAlert
                        summary: false
                      group: query matched
                      id: d0db1fe0-78d6-11ee-9177-f7d404c8c945
                      params:
                        level: info
                        message: "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
                  consumer: stackAlerts
                  name: my Elasticsearch query ESQL rule
                  params:
                    esqlQuery:
                      esql: 'FROM kibana_sample_data_logs | KEEP bytes, clientip, host, geo.dest | where geo.dest != "GB" | STATS sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | SORT sumbytes desc | LIMIT 10'
                    searchType: esqlQuery
                    size: 0
                    threshold:
                      - 0
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 1
                    timeWindowUnit: d
                  rule_type_id: .es-query
                  schedule:
                    interval: 1d
              createEsQueryKqlRuleRequest:
                summary: Elasticsearch query rule (KQL)
                description: Create an Elasticsearch query rule that uses Kibana query language (KQL).
                value:
                  consumer: alerts
                  name: my Elasticsearch query KQL rule
                  params:
                    aggType: count
                    excludeHitsFromPreviousRun: true
                    groupBy: all
                    searchConfiguration:
                      index: 90943e30-9a47-11e8-b64d-95841ca0b247
                      query:
                        language: kuery
                        query: '""geo.src : "US" ""'
                    searchType: searchSource
                    size: 100
                    threshold:
                      - 1000
                    thresholdComparator: '>'
                    timeWindowSize: 5
                    timeWindowUnit: m
                  rule_type_id: .es-query
                  schedule:
                    interval: 1m
              createEsQueryRuleRequest:
                summary: Elasticsearch query rule (DSL)
                description: "Create an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL) to define its query and a server log connector to send notifications.\n"
                value:
                  actions:
                    - frequency:
                        notify_when: onThrottleInterval
                        summary: true
                        throttle: 1d
                      group: query matched
                      id: fdbece50-406c-11ee-850e-c71febc4ca7f
                      params:
                        level: info
                        message: 'The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts.'
                    - frequency:
                        notify_when: onActionGroupChange
                        summary: false
                      group: recovered
                      id: fdbece50-406c-11ee-850e-c71febc4ca7f
                      params:
                        level: info
                        message: Recovered
                  consumer: alerts
                  name: my Elasticsearch query rule
                  params:
                    esQuery: '"""{"query":{"match_all" : {}}}"""'
                    index:
                      - kibana_sample_data_logs
                    size: 100
                    threshold:
                      - 100
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 1
                    timeWindowUnit: d
                  rule_type_id: .es-query
                  schedule:
                    interval: 1d
              createIndexThresholdRuleRequest:
                summary: Index threshold rule
                description: "Create an index threshold rule that uses a server log connector to send notifications when the threshold is met.\n"
                value:
                  actions:
                    - frequency:
                        notify_when: onActionGroupChange
                        summary: false
                      group: threshold met
                      id: 48de3460-f401-11ed-9f8e-399c75a2deeb
                      params:
                        level: info
                        message: "Rule '{{rule.name}}' is active for group '{{context.group}}':\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
                  alert_delay:
                    active: 3
                  consumer: alerts
                  name: my rule
                  params:
                    aggField: sheet.version
                    aggType: avg
                    groupBy: top
                    index:
                      - .test-index
                    termField: name.keyword
                    termSize: 6
                    threshold:
                      - 1000
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 5
                    timeWindowUnit: m
                  rule_type_id: .index-threshold
                  schedule:
                    interval: 1m
                  tags:
                    - cpu
              createTrackingContainmentRuleRequest:
                summary: Tracking containment rule
                description: "Create a tracking containment rule that checks when an entity is contained or no longer contained within a boundary.\n"
                value:
                  consumer: alerts
                  name: my tracking rule
                  params:
                    boundaryGeoField: location
                    boundaryIndexId: 0cd90abf-abe7-44c7-909a-f621bbbcfefc
                    boundaryIndexTitle: boundary*
                    boundaryNameField: name
                    boundaryType: entireIndex
                    dateField": '@timestamp'
                    entity: agent.keyword
                    geoField: geo.coordinates
                    index: kibana_sample_data_logs
                    indexId: 90943e30-9a47-11e8-b64d-95841ca0b247
                  rule_type_id: .geo-containment
                  schedule:
                    interval: 1h
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
              examples:
                createEsQueryEsqlRuleResponse:
                  summary: Elasticsearch query rule (ES|QL)
                  description: The response for successfully creating an Elasticsearch query rule that uses Elasticsearch Query Language (ES|QL).
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActiveAlert
                          summary: false
                          throttle: 'null'
                        group: query matched
                        id: d0db1fe0-78d6-11ee-9177-f7d404c8c945
                        params:
                          level: info
                          message: "Elasticsearch query rule '{{rule.name}}' is active:\n- Value: {{context.value}} - Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}} - Timestamp: {{context.date}} - Link: {{context.link}}"
                        uuid: bfe370a3-531b-4855-bbe6-ad739f578844
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: stackAlerts
                    created_at: '2023-11-01T19:00:10.453Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2023-11-01T19:00:10.453Z'
                      status: pending
                    id: e0d62360-78e8-11ee-9177-f7d404c8c945
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: my Elasticsearch query ESQL rule
                    notify_when: 'null'
                    params:
                      aggType: count
                      esqlQuery:
                        esql: 'FROM kibana_sample_data_logs | keep bytes, clientip, host, geo.dest | WHERE geo.dest != "GB" | stats sumbytes = sum(bytes) by clientip, host | WHERE sumbytes > 5000 | sort sumbytes desc | limit 10'
                      excludeHitsFromPreviousRun": 'true,'
                      groupBy: all
                      searchType: esqlQuery
                      size: 0
                      threshold:
                        - 0
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 1
                      timeWindowUnit: d
                    revision: 0
                    rule_type_id: .es-query
                    running: false
                    schedule:
                      interval: 1d
                    scheduled_task_id: e0d62360-78e8-11ee-9177-f7d404c8c945
                    tags: [ ]
                    throttle: 'null'
                    updated_at: '2023-11-01T19:00:10.453Z'
                    updated_by: 'elastic",'
                createEsQueryKqlRuleResponse:
                  summary: Elasticsearch query rule (KQL)
                  description: The response for successfully creating an Elasticsearch query rule that uses Kibana query language (KQL).
                  value:
                    actions: [ ]
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2023-07-14T20:24:50.729Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2023-07-14T20:24:50.729Z'
                      status: pending
                    id: 7bd506d0-2284-11ee-8fad-6101956ced88
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: my Elasticsearch query KQL rule"
                    notify_when: 'null'
                    params:
                      aggType: count
                      excludeHitsFromPreviousRun: true
                      groupBy: all
                      searchConfiguration:
                        index: 90943e30-9a47-11e8-b64d-95841ca0b247
                        query:
                          language: kuery
                          query: '""geo.src : "US" ""'
                      searchType: searchSource
                      size: 100
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 0
                    rule_type_id: .es-query
                    running: false
                    schedule:
                      interval: 1m
                    scheduled_task_id: 7bd506d0-2284-11ee-8fad-6101956ced88
                    tags: [ ]
                    throttle: 'null'
                    updated_at: '2023-07-14T20:24:50.729Z'
                    updated_by: elastic
                createEsQueryRuleResponse:
                  summary: Elasticsearch query rule (DSL)
                  description: The response for successfully creating an Elasticsearch query rule that uses Elasticsearch query domain specific language (DSL).
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onThrottleInterval
                          summary: true
                          throttle: 1d
                        group: query matched
                        id: fdbece50-406c-11ee-850e-c71febc4ca7f
                        params:
                          level: info
                          message: 'The system has detected {{alerts.new.count}} new, {{alerts.ongoing.count}} ongoing, and {{alerts.recovered.count}} recovered alerts.'
                        uuid: 53f3c2a3-e5d0-4cfa-af3b-6f0881385e78
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActionGroupChange
                          summary: false
                          throttle: 'null'
                        group: recovered
                        id: fdbece50-406c-11ee-850e-c71febc4ca7f
                        params:
                          level: info
                          message: Recovered
                        uuid: 2324e45b-c0df-45c7-9d70-4993e30be758
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2023-08-22T00:03:38.263Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2023-08-22T00:03:38.263Z'
                      status: pending
                    id: 58148c70-407f-11ee-850e-c71febc4ca7f
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: my Elasticsearch query rule
                    notify_when: 'null'
                    params:
                      aggType: count
                      esQuery: '"""{"query":{"match_all" : {}}}"""'
                      excludeHitsFromPreviousRun: true
                      groupBy: all
                      index:
                        - kibana_sample_data_logs
                      searchType: esQuery
                      size: 100
                      threshold:
                        - 100
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 1
                      timeWindowUnit: d
                    revision: 0
                    rule_type_id: .es-query
                    running: false
                    schedule:
                      interval: 1d
                    scheduled_task_id: 58148c70-407f-11ee-850e-c71febc4ca7f
                    tags: [ ]
                    throttle: 'null'
                    updated_at: '2023-08-22T00:03:38.263Z'
                    updated_by: elastic
                createIndexThresholdRuleResponse:
                  summary: Index threshold rule
                  description: The response for successfully creating an index threshold rule.
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActionGroupChange
                          summary: false
                          throttle: 'null'
                        group: threshold met
                        id: dceeb5d0-6b41-11eb-802b-85b0c1bc8ba2
                        params:
                          level: info
                          message: "Rule {{rule.name}} is active for group {{context.group} :\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
                        uuid: 07aef2a0-9eed-4ef9-94ec-39ba58eb609d
                    alert_delay:
                      active: 3
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2022-06-08T17:20:31.632Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_execution_date: '2022-06-08T17:20:31.632Z'
                      status: pending
                    id: 41893910-6bca-11eb-9e0d-85d233e3ee35
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: my rule
                    notify_when: 'null'
                    params:
                      aggField: sheet.version
                      aggType: avg
                      groupBy: top
                      index:
                        - .test-index
                      termField: name.keyword
                      termSize: 6
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 0
                    rule_type_id: .index-threshold
                    running: false
                    schedule:
                      interval: 1m
                    scheduled_task_id: 425b0800-6bca-11eb-9e0d-85d233e3ee35
                    tags:
                      - cpu
                    throttle: 'null'
                    updated_at: '2022-06-08T17:20:31.632Z'
                    updated_by: elastic
                createTrackingContainmentRuleResponse:
                  summary: Tracking containment rule
                  description: The response for successfully creating a tracking containment rule.
                  value:
                    actions: [ ]
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2024-02-14T19:52:55.920Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_duration: 74
                      last_execution_date: '2024-02-15T03:25:38.125Z'
                      status: ok
                    id: b6883f9d-5f70-4758-a66e-369d7c26012f
                    last_run:
                      alerts_count:
                        active: 0
                        ignored: 0
                        new: 0
                        recovered: 0
                      outcome: succeeded
                      outcome_msg: 'null'
                      outcome_order: 0
                      warning: 'null'
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: my tracking rule
                    next_run: '2024-02-15T03:26:38.033Z'
                    notify_when: 'null'
                    params:
                      boundaryGeoField: location
                      boundaryIndexId: 0cd90abf-abe7-44c7-909a-f621bbbcfefc
                      boundaryIndexTitle: boundary*
                      boundaryNameField: name
                      boundaryType: entireIndex
                      dateField: '@timestamp'
                      entity: agent.keyword
                      geoField: geo.coordinates
                      index: kibana_sample_data_logs
                      indexId: 90943e30-9a47-11e8-b64d-95841ca0b247
                    revision: 1
                    rule_type_id: .geo-containment
                    running: false
                    schedule:
                      interval: 1h
                    scheduled_task_id: b6883f9d-5f70-4758-a66e-369d7c26012f
                    tags: [ ]
                    throttle: 'null'
                    updated_at: '2024-02-15T03:24:32.574Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '409':
          description: Indicates that the rule id is already in use.
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - alerting
      summary: Update a rule
      operationId: put-alerting-rule-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_rule'
            examples:
              updateRuleRequest:
                summary: Index threshold rule
                description: Update an index threshold rule that uses a server log connector to send notifications when the threshold is met.
                value:
                  actions:
                    - frequency:
                        notify_when: onActionGroupChange
                        summary: false
                      group: threshold met
                      id: 96b668d0-a1b6-11ed-afdf-d39a49596974
                      params:
                        level: info
                        message: "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
                  name: new name
                  params:
                    aggField: sheet.version
                    aggType: avg
                    groupBy: top
                    index:
                      - .updated-index
                    termField: name.keyword
                    termSize: 6
                    threshold:
                      - 1000
                    thresholdComparator: '>'
                    timeField: '@timestamp'
                    timeWindowSize: 5
                    timeWindowUnit: m
                  schedule:
                    interval: 1m
                  tags: [ ]
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
              examples:
                updateRuleResponse:
                  summary: Index threshold rule
                  description: The response for successfully updating an index threshold rule.
                  value:
                    actions:
                      - connector_type_id: .server-log
                        frequency:
                          notify_when: onActionGroupChange
                          summary: false
                          throttle: 'null'
                        group: threshold met
                        id: 96b668d0-a1b6-11ed-afdf-d39a49596974
                        params:
                          level: info
                          message: "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}"
                        uuid: 07aef2a0-9eed-4ef9-94ec-39ba58eb609d
                    api_key_created_by_user: false
                    api_key_owner: elastic
                    consumer: alerts
                    created_at: '2024-03-26T23:13:20.985Z'
                    created_by: elastic
                    enabled: true
                    execution_status:
                      last_duration: 52
                      last_execution_date: '2024-03-26T23:22:51.390Z'
                      status: ok
                    id: ac4e6b90-6be7-11eb-ba0d-9b1c1f912d74
                    last_run:
                      alerts_count:
                        active: 0
                        ignored: 0
                        new: 0
                        recovered: 0
                      outcome: succeeded
                      outcome_msg: 'null'
                      warning: 'null'
                    mute_all: false
                    muted_alert_ids: [ ]
                    name: new name
                    next_run: '2024-03-26T23:23:51.316Z'
                    params:
                      aggField: sheet.version
                      aggType: avg
                      groupBy: top
                      index:
                        - .updated-index
                      termField: name.keyword
                      termSize: 6
                      threshold:
                        - 1000
                      thresholdComparator: '>'
                      timeField: '@timestamp'
                      timeWindowSize: 5
                      timeWindowUnit: m
                    revision: 1
                    rule_type_id: .index-threshold
                    running: false
                    schedule:
                      interval: 1m
                    scheduled_task_id: 4c5eda00-e74f-11ec-b72f-5b18752ff9ea
                    tags: [ ]
                    throttle: 'null'
                    updated_at: '2024-03-26T23:22:59.949Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
        '409':
          description: Indicates that the rule has already been updated by another user.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/_disable':
    post:
      tags:
        - alerting
      summary: Disable a rule
      operationId: post-alerting-rule-id-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type:
                - 'null'
                - object
              properties:
                untrack:
                  type: boolean
                  description: Defines whether this rule's alerts should be untracked.
              additionalProperties: false
              default: 'null'
            examples:
              disableRuleRequest:
                summary: Disable a rule and untrack its alerts
                description: A request that disables a rule and untracks all alerts that were generated by the rule.
                value:
                  untrack: true
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/_enable':
    post:
      tags:
        - alerting
      summary: Enable a rule
      operationId: post-alerting-rule-id-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/_mute_all':
    post:
      tags:
        - alerting
      summary: Mute all alerts
      operationId: post-alerting-rule-id-mute-all
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/_unmute_all':
    post:
      tags:
        - alerting
      summary: Unmute all alerts
      operationId: post-alerting-rule-id-unmute-all
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/_update_api_key':
    post:
      tags:
        - alerting
      summary: Update the API key for a rule
      operationId: post-alerting-rule-id-update-api-key
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
        '409':
          description: Indicates that the rule has already been updated by another user.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/query_inspector':
    get:
      tags:
        - alerting
      summary: Get the Elasticsearch query for a rule
      description: 'Returns the Elasticsearch query that a rule executes, and optionally its response.'
      operationId: get-alerting-rule-id-query-inspector
      parameters:
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
        - name: mode
          in: query
          description: 'The inspection mode. Use "build" to return only the query, or "execute" to run the query and include the response.'
          schema:
            enum:
              - build
              - execute
            type: string
            default: build
        - name: alert_id
          in: query
          description: 'The alert document ID. When provided, the query inspector uses the evaluation time range from the alert instead of the current time.'
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - queries
                type: object
                properties:
                  queries:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - index
                        - request
                      type: object
                      properties:
                        index:
                          type: string
                        label:
                          type: string
                        request:
                          type: object
                          additionalProperties: { }
                        response:
                          type: object
                          additionalProperties: { }
                      additionalProperties: false
                additionalProperties: false
              examples:
                getRuleQueryInspectorResponse:
                  summary: A query inspector response for a custom threshold rule
                  value:
                    queries:
                      - index: metrics-*
                        request:
                          aggs:
                            groupings:
                              composite:
                                size: 500
                                sources: [ ]
                          query:
                            bool:
                              filter:
                                - range:
                                    '@timestamp':
                                      gte: '2026-01-01T00:00:00.000Z'
                                      lte: '2026-01-01T00:05:00.000Z'
                          size: 0
        '400':
          description: Indicates the rule type is not supported or the request parameters are invalid.
        '404':
          description: Indicates a rule with the specified rule ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{id}/snooze_schedule':
    post:
      tags:
        - alerting
      summary: Schedule a snooze for the rule
      description: 'When you snooze a rule, the rule checks continue to run but alerts will not generate actions. You can snooze for a specified period of time and schedule single or recurring downtimes.'
      operationId: post-alerting-rule-id-snooze-schedule
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: Identifier of the rule.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - schedule
              type: object
              properties:
                schedule:
                  type: object
                  properties:
                    custom:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_schedule_request'
                  additionalProperties: false
              additionalProperties: false
            examples:
              snoozeRuleRecurringRequest:
                summary: Snooze a rule on a recurring weekly schedule
                description: 'A request that snoozes a rule every Monday for 8 hours, for 4 occurrences.'
                value:
                  schedule:
                    custom:
                      duration: 8h
                      recurring:
                        every: 1w
                        occurrences: 4
                        onWeekDay:
                          - MO
                      start: '2025-03-17T09:00:00.000Z'
                      timezone: UTC
              snoozeRuleRequest:
                summary: Snooze a rule for 24 hours
                description: A request that snoozes a rule for 24 hours starting now.
                value:
                  schedule:
                    custom:
                      duration: 24h
                      start: '2025-03-12T12:00:00.000Z'
                      timezone: UTC
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - body
                type: object
                properties:
                  body:
                    required:
                      - schedule
                    type: object
                    properties:
                      schedule:
                        required:
                          - id
                        type: object
                        properties:
                          custom:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_schedule_request'
                          id:
                            type: string
                            description: Identifier of the snooze schedule.
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                snoozeRuleResponse:
                  summary: Snooze schedule response
                  description: A response that contains the created snooze schedule.
                  value:
                    schedule:
                      custom:
                        duration: 24h
                        start: '2025-03-12T12:00:00.000Z'
                        timezone: UTC
                      id: 9ac67950-6737-11ec-8ded-d7f6e1581b26
        '400':
          description: Indicates an invalid schema.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given id does not exist.
      x-state: Generally available; added in 8.19.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{rule_id}/alert/{alert_id}/_mute':
    post:
      tags:
        - alerting
      summary: Mute an alert
      operationId: post-alerting-rule-rule-id-alert-alert-id-mute
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: rule_id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
        - name: alert_id
          in: path
          description: The identifier for the alert.
          required: true
          schema:
            type: string
        - name: validate_alerts_existence
          in: query
          description: Whether to validate the existence of the alert.
          schema:
            type: boolean
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule or alert with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{rule_id}/alert/{alert_id}/_snooze':
    post:
      tags:
        - alerting
      summary: Snooze an alert
      operationId: post-alerting-rule-rule-id-alert-alert-id-snooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: rule_id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: alert_id
          in: path
          description: The identifier for the alert.
          required: true
          schema:
            maxLength: 1000
            type: string
        - name: validate_alerts_existence
          in: query
          description: 'Set to `true` to validate that the specified alert exists. If a `400` error is returned, the specified alert does not exist. Defaults to `true`.'
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                condition_operator:
                  enum:
                    - any
                    - all
                  type: string
                  description: 'Logical operator applied to the conditions array. "any" expires the snooze when at least one condition is met; "all" requires every condition to be met. When conditions are provided but this field is omitted, defaults to "any".'
                conditions:
                  maxItems: 10
                  type: array
                  items:
                    anyOf:
                      - required:
                          - type
                          - field
                        type: object
                        properties:
                          field:
                            maxLength: 1000
                            type: string
                            description: 'The alert field to watch, written as a dot-notation path. When the value of the specified alert field changes, the snooze expires'
                          type:
                            enum:
                              - field_change
                            type: string
                        additionalProperties: false
                        description: Expires the snooze when the value of the specified alert field changes.
                      - required:
                          - type
                        type: object
                        properties:
                          type:
                            enum:
                              - severity_change
                            type: string
                        additionalProperties: false
                        description: Expires the snooze when the severity of the specified alert changes.
                      - required:
                          - type
                          - value
                        type: object
                        properties:
                          type:
                            enum:
                              - severity_equals
                            type: string
                          value:
                            enum:
                              - critical
                              - major
                              - high
                              - medium
                              - minor
                              - low
                              - warning
                              - info
                            type: string
                            description: 'The target severity level: critical, major, high, medium, minor, low, warning, or info.'
                        additionalProperties: false
                        description: Expires the snooze when the severity of the specified alert equals a target level.
                  description: 'One or more conditions that, when met, automatically expire the snooze. Supported types: `field_change`, `severity_change`, `severity_equals`.'
                expires_at:
                  maxLength: 30
                  type: string
                  description: 'The datetime at which the snooze expires, in ISO 8601 format (`YYYY-MM-DDTHH:mm:ss.sssZ`). When omitted, the snooze persists indefinitely unless manually removed or a defined condition is met.'
              additionalProperties: false
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates the specified rule or alert doesn't exist.
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{rule_id}/alert/{alert_id}/_unmute':
    post:
      tags:
        - alerting
      summary: Unmute an alert
      operationId: post-alerting-rule-rule-id-alert-alert-id-unmute
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: rule_id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
        - name: alert_id
          in: path
          description: The identifier for the alert.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule or alert with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{rule_id}/alert/{alert_id}/_unsnooze':
    post:
      tags:
        - alerting
      summary: Unsnooze an alert
      operationId: post-alerting-rule-rule-id-alert-alert-id-unsnooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: rule_id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: alert_id
          in: path
          description: The identifier for the alert.
          required: true
          schema:
            maxLength: 1000
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates the specified rule or alert doesn't exist.
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rule/{ruleId}/snooze_schedule/{scheduleId}':
    delete:
      tags:
        - alerting
      summary: Delete a snooze schedule for a rule
      operationId: delete-alerting-rule-ruleid-snooze-schedule-scheduleid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: ruleId
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            type: string
        - name: scheduleId
          in: path
          description: The identifier for the snooze schedule.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given id does not exist.
      x-state: Generally available; added in 8.19.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rules/_find:
    get:
      tags:
        - alerting
      summary: Get information about rules
      operationId: get-alerting-rules-find
      parameters:
        - name: per_page
          in: query
          description: The number of rules to return per page.
          schema:
            minimum: 0
            type: number
            default: 10
        - name: page
          in: query
          description: The page number to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: search
          in: query
          description: An Elasticsearch simple_query_string query that filters the objects in the response.
          schema:
            type: string
        - name: default_search_operator
          in: query
          description: The default operator to use for the simple_query_string.
          schema:
            enum:
              - OR
              - AND
            type: string
            default: OR
        - name: search_fields
          in: query
          description: The fields to perform the simple_query_string parsed query against.
          schema:
            type: array
            items:
              type: string
        - name: sort_field
          in: query
          description: Determines which field is used to sort the results. The field must exist in the `attributes` key of the response.
          schema:
            type: string
        - name: sort_order
          in: query
          description: Determines the sort order.
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: has_reference
          in: query
          description: Filters the rules that have a relation with the reference objects with a specific type and identifier.
          schema:
            required:
              - type
              - id
            type:
              - 'null'
              - object
            properties:
              id:
                type: string
              type:
                type: string
            additionalProperties: false
        - name: fields
          in: query
          description: The fields to return in the `attributes` key of the response.
          schema:
            type: array
            items:
              type: string
        - name: filter
          in: query
          description: 'A KQL string that you filter with an attribute from your saved object. It should look like `savedObjectType.attributes.title: "myTitle"`. However, if you used a direct attribute of a saved object, such as `updatedAt`, you must define your filter, for example, `savedObjectType.updatedAt > 2018-12-22`.'
          schema:
            type: string
        - name: filter_consumers
          in: query
          description: 'Filters the returned rules by the consumer (Kibana application) that owns them, for example: `siem`, `apm`, `infrastructure`.'
          schema:
            type: array
            items:
              type: string
              description: List of consumers to filter.
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - page
                  - per_page
                  - total
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_response'
                  page:
                    type: number
                  per_page:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                findConditionalActionRulesResponse:
                  summary: Index threshold rule
                  description: A response that contains information about an index threshold rule.
                  value:
                    data:
                      - actions:
                          - frequency:
                              notify_when: onActionGroupChange
                              summary: false
                              throttle: 'null'
                            group: threshold met
                            id: 9dca3e00-74f5-11ed-9801-35303b735aef
                            params:
                              connector_type_id: .server-log
                              level: info
                              message: "Rule {{rule.name}} is active for group {{context.group}}:\n\n- Value: {{context.value}}\n- Conditions Met: {{context.conditions}} over {{rule.params.timeWindowSize}}{{rule.params.timeWindowUnit}}\n- Timestamp: {{context.date}}"
                            uuid: 1c7a1280-f28c-4e06-96b2-e4e5f05d1d61
                        api_key_created_by_user: false
                        api_key_owner: elastic
                        consumer: alerts
                        created_at: '2022-12-05T23:40:33.132Z'
                        created_by: elastic
                        enabled: true
                        execution_status:
                          last_duration: 48
                          last_execution_date: '2022-12-06T01:44:23.983Z'
                          status: ok
                        id: 3583a470-74f6-11ed-9801-35303b735aef
                        last_run:
                          alerts_count:
                            active: 0
                            ignored: 0
                            new: 0
                            recovered: 0
                          outcome: succeeded
                          outcome_msg: 'null'
                          warning: 'null'
                        mute_all: false
                        muted_alert_ids: [ ]
                        name: my alert
                        next_run: '2022-12-06T01:45:23.912Z'
                        params:
                          aggField: sheet.version
                          aggType: avg
                          groupBy: top
                          index:
                            - test-index
                          termField: name.keyword
                          termSize: 6
                          threshold:
                            - 1000
                          thresholdComparator: '>'
                          timeField: '@timestamp'
                          timeWindowSize: 5
                          timeWindowUnit: m
                        revision: 1
                        rule_type_id: .index-threshold
                        schedule:
                          interval: 1m
                        scheduled_task_id: 3583a470-74f6-11ed-9801-35303b735aef
                        tags:
                          - cpu
                        throttle: 'null'
                        updated_at: '2022-12-05T23:40:33.132Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
                findRulesResponse:
                  summary: Security rule
                  description: A response that contains information about a security rule that has conditional actions.
                  value:
                    data:
                      - actions:
                          - alerts_filter:
                              query:
                                filters:
                                  - $state:
                                      store: appState
                                    meta:
                                      alias: 'null'
                                      disabled: false
                                      field: client.geo.region_iso_code
                                      index: c4bdca79-e69e-4d80-82a1-e5192c621bea
                                      key: client.geo.region_iso_code
                                      negate: false
                                      params:
                                        query: CA-QC
                                        type: phrase
                                    query:
                                      match_phrase:
                                        client.geo.region_iso_code: CA-QC
                                kql: ''
                              timeframe:
                                days:
                                  - 7
                                hours:
                                  end: '17:00'
                                  start: '08:00'
                                timezone: UTC
                            connector_type_id: .index
                            frequency:
                              notify_when: onActiveAlert
                              summary: true
                              throttle: 'null'
                            group: default
                            id: 49eae970-f401-11ed-9f8e-399c75a2deeb
                            params:
                              documents:
                                - alert_id:
                                    '[object Object]': 'null'
                                  context_message:
                                    '[object Object]': 'null'
                                  rule_id:
                                    '[object Object]': 'null'
                                  rule_name:
                                    '[object Object]': 'null'
                            uuid: 1c7a1280-f28c-4e06-96b2-e4e5f05d1d61
                        api_key_created_by_user: false
                        api_key_owner: elastic
                        consumer: siem
                        created_at: '2023-05-16T15:50:28.358Z'
                        created_by: elastic
                        enabled: true
                        execution_status:
                          last_duration: 166
                          last_execution_date: '2023-05-16T20:26:49.590Z'
                          status: ok
                        id: 6107a8f0-f401-11ed-9f8e-399c75a2deeb
                        last_run:
                          alerts_count:
                            active: 0
                            ignored: 0
                            new: 0
                            recovered: 0
                          outcome: succeeded
                          outcome_msg:
                            - Rule execution completed successfully
                          outcome_order: 0
                          warning: 'null'
                        mute_all: false
                        muted_alert_ids: [ ]
                        name: security_rule
                        next_run: '2023-05-16T20:27:49.507Z'
                        notify_when: 'null'
                        params:
                          author: [ ]
                          description: A security threshold rule.
                          exceptionsList: [ ]
                          falsePositives: [ ]
                          filters: [ ]
                          from: now-3660s
                          immutable: false
                          index:
                            - kibana_sample_data_logs
                          language: kuery
                          license: ''
                          maxSignals: 100
                          meta:
                            from: 1h
                            kibana_siem_app_url: https://localhost:5601/app/security
                          outputIndex: ''
                          query: '*'
                          references: [ ]
                          riskScore: 21
                          riskScoreMapping: [ ]
                          ruleId: an_internal_rule_id
                          severity: low
                          severityMapping: [ ]
                          threat: [ ]
                          threshold:
                            cardinality: [ ]
                            field:
                              - bytes
                            value: 1
                          to: now
                          type: threshold
                          version: 1
                        revision: 1
                        rule_type_id: siem.thresholdRule
                        running: false
                        schedule:
                          interval: 1m
                        scheduled_task_id: 6107a8f0-f401-11ed-9f8e-399c75a2deeb
                        tags: [ ]
                        throttle: 'null'
                        updated_at: '2023-05-16T20:25:42.559Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rules/backfill/_find:
    post:
      tags:
        - alerting
      summary: Find backfills for rules
      operationId: post-alerting-rules-backfill-find
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: end
          in: query
          description: The end date for filtering backfills.
          schema:
            type: string
        - name: page
          in: query
          description: The page number to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of backfills to return per page.
          schema:
            minimum: 0
            type: number
            default: 10
        - name: rule_ids
          in: query
          description: A comma-separated list of rule identifiers.
          schema:
            type: string
        - name: initiator
          in: query
          description: 'The initiator of the backfill, either `user` for manual backfills or `system` for automatic gap fills.'
          schema:
            enum:
              - user
              - system
            type: string
        - name: start
          in: query
          description: The start date for filtering backfills.
          schema:
            type: string
        - name: sort_field
          in: query
          description: The field to sort backfills by.
          schema:
            enum:
              - createdAt
              - start
            type: string
        - name: sort_order
          in: query
          description: The sort order.
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_find_backfill_response'
              examples:
                findBackfillResponse:
                  summary: Find backfills response
                  value:
                    data:
                      - created_at: '2024-01-30T00:00:00.000Z'
                        duration: 12h
                        enabled: true
                        id: 85bdf571-f4fb-4666-a8d2-e05e1220ebc6
                        initiator: user
                        rule:
                          api_key_owner: elastic
                          consumer: alerts
                          created_at: '2022-12-05T23:40:33.132Z'
                          created_by: elastic
                          enabled: true
                          id: 3583a470-74f6-11ed-9801-35303b735aef
                          name: my alert
                          params:
                            aggField: sheet.version
                            aggType: avg
                            groupBy: top
                            index:
                              - test-index
                            termField: name.keyword
                            termSize: 6
                            threshold:
                              - 1000
                            thresholdComparator: '>'
                            timeField: '@timestamp'
                            timeWindowSize: 5
                            timeWindowUnit: m
                          revision: 0
                          rule_type_id: .index-threshold
                          schedule:
                            interval: 1m
                          tags:
                            - cpu
                          updated_at: '2022-12-05T23:40:33.132Z'
                          updated_by: elastic
                        schedule:
                          - interval: 12h
                            run_at: '2024-01-01T12:00:00.000Z'
                            status: pending
                          - interval: 12h
                            run_at: '2024-01-02T00:00:00.000Z'
                            status: pending
                        space_id: default
                        start: '2024-01-01T00:00:00.000Z'
                        status: pending
                    page: 1
                    per_page: 10
                    total: 1
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/rules/backfill/_schedule:
    post:
      tags:
        - alerting
      summary: Schedule a backfill for rules
      operationId: post-alerting-rules-backfill-schedule
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              maxItems: 100
              minItems: 1
              type: array
              items:
                required:
                  - rule_id
                  - ranges
                type: object
                properties:
                  ranges:
                    type: array
                    items:
                      required:
                        - start
                        - end
                      type: object
                      properties:
                        end:
                          type: string
                        start:
                          type: string
                      additionalProperties: false
                  rule_id:
                    type: string
                  run_actions:
                    type: boolean
                additionalProperties: false
            examples:
              scheduleBackfillRequest:
                summary: Schedule a backfill for an index threshold rule
                value:
                  - ranges:
                      - end: '2024-01-02T00:00:00.000Z'
                        start: '2024-01-01T00:00:00.000Z'
                    rule_id: 3583a470-74f6-11ed-9801-35303b735aef
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_response'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_error_response'
              examples:
                scheduleBackfillResponse:
                  summary: Schedule backfill response
                  value:
                    - created_at: '2024-01-30T00:00:00.000Z'
                      duration: 12h
                      enabled: true
                      id: 85bdf571-f4fb-4666-a8d2-e05e1220ebc6
                      initiator: user
                      rule:
                        api_key_owner: elastic
                        consumer: alerts
                        created_at: '2022-12-05T23:40:33.132Z'
                        created_by: elastic
                        enabled: true
                        id: 3583a470-74f6-11ed-9801-35303b735aef
                        name: my alert
                        params:
                          aggField: sheet.version
                          aggType: avg
                          groupBy: top
                          index:
                            - test-index
                          termField: name.keyword
                          termSize: 6
                          threshold:
                            - 1000
                          thresholdComparator: '>'
                          timeField: '@timestamp'
                          timeWindowSize: 5
                          timeWindowUnit: m
                        revision: 0
                        rule_type_id: .index-threshold
                        schedule:
                          interval: 1m
                        tags:
                          - cpu
                        updated_at: '2022-12-05T23:40:33.132Z'
                        updated_by: elastic
                      schedule:
                        - interval: 12h
                          run_at: '2024-01-01T12:00:00.000Z'
                          status: pending
                        - interval: 12h
                          run_at: '2024-01-02T00:00:00.000Z'
                          status: pending
                      space_id: default
                      start: '2024-01-01T00:00:00.000Z'
                      status: pending
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a rule with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/rules/backfill/{id}':
    delete:
      tags:
        - alerting
      summary: Delete a backfill by ID
      operationId: delete-alerting-rules-backfill-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the backfill.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a backfill with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - alerting
      summary: Get a backfill by ID
      operationId: get-alerting-rules-backfill-id
      parameters:
        - name: id
          in: path
          description: The identifier for the backfill.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_response'
              examples:
                getBackfillResponse:
                  summary: Get a backfill for an index threshold rule
                  value:
                    created_at: '2024-01-30T00:00:00.000Z'
                    duration: 12h
                    enabled: true
                    id: 85bdf571-f4fb-4666-a8d2-e05e1220ebc6
                    initiator: user
                    rule:
                      api_key_owner: elastic
                      consumer: alerts
                      created_at: '2022-12-05T23:40:33.132Z'
                      created_by: elastic
                      enabled: true
                      id: 3583a470-74f6-11ed-9801-35303b735aef
                      name: my alert
                      params:
                        aggField: sheet.version
                        aggType: avg
                        groupBy: top
                        index:
                          - test-index
                        termField: name.keyword
                        termSize: 6
                        threshold:
                          - 1000
                        thresholdComparator: '>'
                        timeField: '@timestamp'
                        timeWindowSize: 5
                        timeWindowUnit: m
                      revision: 0
                      rule_type_id: .index-threshold
                      schedule:
                        interval: 1m
                      tags:
                        - cpu
                      updated_at: '2022-12-05T23:40:33.132Z'
                      updated_by: elastic
                    schedule:
                      - interval: 12h
                        run_at: '2024-01-01T12:00:00.000Z'
                        status: pending
                      - interval: 12h
                        run_at: '2024-01-02T00:00:00.000Z'
                        status: pending
                    space_id: default
                    start: '2024-01-01T00:00:00.000Z'
                    status: pending
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a backfill with the given ID does not exist.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies:
    get:
      tags:
        - alerting-v2
      summary: List action policies
      description: 'Get a paginated list of action policies with optional filtering and sorting.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.'
      operationId: get-alerting-v2-action-policies
      parameters:
        - name: page
          in: query
          description: The page number to return. Defaults to 1.
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - name: per_page
          in: query
          description: The number of action policies to return per page. Defaults to 20.
          schema:
            maximum: 100
            minimum: 1
            type: integer
        - name: search
          in: query
          description: A text string to search across action policy fields.
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - name: enabled
          in: query
          description: Filter by enabled status. Accepts the strings true or false.
          schema:
            enum:
              - 'true'
              - 'false'
            type: string
        - name: sort_field
          in: query
          description: The field to sort action policies by.
          schema:
            enum:
              - name
              - created_at
              - updated_at
            type: string
        - name: sort_order
          in: query
          description: The sort direction.
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          description: Returns a paginated list of action policies.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_list_response'
              examples:
                listActionPoliciesResponse:
                  summary: A page of action policies
                  value:
                    items:
                      - auth:
                          created_by_user: true
                          owner: elastic
                        created_at: '2026-01-15T12:00:00.000Z'
                        created_by: elastic
                        description: Sends notifications for alerts generated by rules with the production tag.
                        destinations:
                          - id: workflow-1
                            type: workflow
                        enabled: true
                        group_by: 'null'
                        grouping_mode: per_episode
                        id: action-policy-1
                        matcher:
                          tags:
                            - production
                        name: Notify on production alerts
                        snoozed_until: 'null'
                        throttle:
                          interval: 'null'
                          strategy: on_status_change
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by: elastic
                        version: WzAsMV0=
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - alerting-v2
      summary: Create an action policy
      description: 'Creates an action policy with a server-generated identifier. To create or replace an action policy with a client-supplied identifier, use PUT /api/alerting/v2/action_policies/{id}/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.'
      operationId: post-alerting-v2-action-policies
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_action_policy'
            examples:
              createActionPolicyRequest:
                summary: Notification for alerts from rules with the production tag
                value:
                  description: Sends notifications for alerts generated by rules with the production tag.
                  destinations:
                    - id: workflow-1
                      type: workflow
                  grouping_mode: per_episode
                  matcher:
                    tags:
                      - production
                  name: Notify on production alerts
                  throttle:
                    strategy: on_status_change
      responses:
        '201':
          description: Returns the newly created action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                createActionPolicyResponse:
                  summary: Newly created action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: create
                      errors:
                        errors: [ ]
                        properties:
                          name:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating create action policy data - name: Invalid input: expected string, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_delete:
    post:
      tags:
        - alerting-v2
      summary: Delete action policies in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-delete
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkDeleteActionPoliciesRequest:
                summary: Delete two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
      responses:
        '200':
          description: Returns the result of the bulk delete operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkDeleteActionPoliciesResponse:
                  summary: All targeted policies deleted
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_disable:
    post:
      tags:
        - alerting-v2
      summary: Disable action policies in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkDisableActionPoliciesRequest:
                summary: Disable two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
      responses:
        '200':
          description: Returns the result of the bulk disable operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkDisableActionPoliciesResponse:
                  summary: All targeted policies disabled
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_enable:
    post:
      tags:
        - alerting-v2
      summary: Enable action policies in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkEnableActionPoliciesRequest:
                summary: Enable two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
      responses:
        '200':
          description: Returns the result of the bulk enable operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkEnableActionPoliciesResponse:
                  summary: All targeted policies enabled
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_snooze:
    post:
      tags:
        - alerting-v2
      summary: Snooze action policies in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-snooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request'
            examples:
              bulkSnoozeActionPoliciesRequest:
                summary: Snooze two action policies until a specific timestamp
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
                  snoozed_until: '2026-01-16T12:00:00.000Z'
      responses:
        '200':
          description: Returns the result of the bulk snooze operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkSnoozeActionPoliciesResponse:
                  summary: All targeted policies snoozed
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          snoozed_until:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'snoozed_until: Invalid input: expected string, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_unsnooze:
    post:
      tags:
        - alerting-v2
      summary: Cancel snooze for action policies in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-unsnooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkUnsnoozeActionPoliciesRequest:
                summary: Cancel snooze for two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
      responses:
        '200':
          description: Returns the result of the bulk unsnooze operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkUnsnoozeActionPoliciesResponse:
                  summary: All targeted policies unsnoozed
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/action_policies/_bulk_update_api_key:
    post:
      tags:
        - alerting-v2
      summary: Rotate API keys for action policies in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-bulk-update-api-key
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkUpdateApiKeyActionPoliciesRequest:
                summary: Rotate API keys for two action policies by ID
                value:
                  ids:
                    - action-policy-1
                    - action-policy-2
      responses:
        '200':
          description: Returns the result of the bulk API key rotation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkUpdateApiKeyActionPoliciesResponse:
                  summary: All targeted policies had their API keys rotated
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          ids:
                            errors:
                              - 'Invalid input: expected array, received undefined'
                    error: Bad Request
                    message: 'ids: Invalid input: expected array, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/action_policies/{id}':
    delete:
      tags:
        - alerting-v2
      summary: Delete an action policy
      description: 'Deletes the action policy whose ID you include in the URL path. Use the `id` returned when you created the policy, or from get or list. This request has no body.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: delete-alerting-v2-action-policies-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '204':
          description: The action policy was deleted successfully.
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - alerting-v2
      summary: Get an action policy
      description: 'Get an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-action-policies.'
      operationId: get-alerting-v2-action-policies-id
      parameters:
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the requested action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                getActionPolicyResponse:
                  summary: An action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - alerting-v2
      summary: Partially update an action policy.
      description: 'Apply a partial update to an existing action policy. Fields not present in the body are left unchanged.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.'
      operationId: patch-alerting-v2-action-policies-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_update_action_policy'
            examples:
              updateActionPolicyRequest:
                summary: Rename and update the description
                value:
                  description: Updated description.
                  name: Notify on production alerts (updated)
                  version: WzAsMV0=
      responses:
        '200':
          description: Returns the updated action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                updateActionPolicyResponse:
                  summary: Updated action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Updated description.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts (updated)
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: update
                      errors:
                        errors: [ ]
                        properties:
                          name:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating update action policy data - name: Invalid input: expected string, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '409':
          description: Indicates the action policy was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - alerting-v2
      summary: Create or replace an action policy
      description: 'Creates an action policy with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies AND read_alerting-v2-rules.'
      operationId: put-alerting-v2-action-policies-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_action_policy'
            examples:
              upsertActionPolicyRequest:
                summary: Action policy to create or replace at the given ID
                value:
                  description: Sends notifications for alerts generated by rules with the production tag.
                  destinations:
                    - id: workflow-1
                      type: workflow
                  grouping_mode: per_episode
                  matcher:
                    tags:
                      - production
                  name: Notify on production alerts
                  throttle:
                    strategy: on_status_change
      responses:
        '200':
          description: Returns the replaced action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                upsertActionPolicyReplacedResponse:
                  summary: Replaced an existing action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '201':
          description: Returns the newly created action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                upsertActionPolicyCreatedResponse:
                  summary: Created a new action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: INVALID_ACTION_POLICY_DATA
                    details:
                      context: upsert
                      errors:
                        errors: [ ]
                        properties:
                          name:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'Error validating upsert action policy data - name: Invalid input: expected string, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '409':
          description: Indicates the action policy was created or updated concurrently by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/action_policies/{id}/_disable':
    post:
      tags:
        - alerting-v2
      summary: Disable an action policy
      description: 'Disable an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the disabled action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                disableActionPolicyResponse:
                  summary: Disabled action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: false
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '409':
          description: Indicates the action policy was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/action_policies/{id}/_enable':
    post:
      tags:
        - alerting-v2
      summary: Enable an action policy
      description: 'Enable an action policy by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the enabled action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                enableActionPolicyResponse:
                  summary: Enabled action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '409':
          description: Indicates the action policy was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/action_policies/{id}/_snooze':
    post:
      tags:
        - alerting-v2
      summary: Snooze an action policy
      description: 'Snooze an action policy until a specified time.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-snooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_snooze_action_policy_request'
            examples:
              snoozeActionPolicyRequest:
                summary: Snooze until a specific timestamp
                value:
                  snoozed_until: '2026-01-16T12:00:00.000Z'
      responses:
        '200':
          description: Returns the snoozed action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                snoozeActionPolicyResponse:
                  summary: Snoozed action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: '2026-01-16T12:00:00.000Z'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          snoozed_until:
                            errors:
                              - 'Invalid input: expected string, received undefined'
                    error: Bad Request
                    message: 'snoozed_until: Invalid input: expected string, received undefined'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '409':
          description: Indicates the action policy was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/action_policies/{id}/_unsnooze':
    post:
      tags:
        - alerting-v2
      summary: Unsnooze an action policy
      description: 'Remove the snooze from an action policy.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-unsnooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the unsnoozed action policy.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
              examples:
                unsnoozeActionPolicyResponse:
                  summary: Unsnoozed action policy
                  value:
                    auth:
                      created_by_user: true
                      owner: elastic
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    description: Sends notifications for alerts generated by rules with the production tag.
                    destinations:
                      - id: workflow-1
                        type: workflow
                    enabled: true
                    group_by: 'null'
                    grouping_mode: per_episode
                    id: action-policy-1
                    matcher:
                      tags:
                        - production
                    name: Notify on production alerts
                    snoozed_until: 'null'
                    throttle:
                      interval: 'null'
                      strategy: on_status_change
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '409':
          description: Indicates the action policy was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/action_policies/{id}/_update_api_key':
    post:
      tags:
        - alerting-v2
      summary: Update an action policy API key
      description: 'Rotate the API key for an action policy.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-action-policies.'
      operationId: post-alerting-v2-action-policies-id-update-api-key
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The ID of the action policy. Copy it from the response when you create a policy, fetch one policy, or fetch the policy list.'
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '204':
          description: The API key of the action policy was updated successfully.
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates an action policy with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyNotFound:
                  summary: Indicates an action policy with the given ID does not exist.
                  value:
                    code: ACTION_POLICY_NOT_FOUND
                    details:
                      action_policy_id: action-policy-1
                    error: Not Found
                    message: Action policy with ID "action-policy-1" not found
        '409':
          description: Indicates the action policy was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                actionPolicyVersionConflict:
                  summary: Indicates the action policy was concurrently updated by another caller.
                  value:
                    code: ACTION_POLICY_VERSION_CONFLICT
                    details:
                      action_policy_id: action-policy-1
                    error: Conflict
                    message: Action policy with ID "action-policy-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/episodes/_bulk_ack:
    post:
      tags:
        - alerting-v2
      summary: Bulk acknowledge alert episodes
      description: 'Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-bulk-ack
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_ack_episodes_request'
            examples:
              bulkAckEpisodeActionRequest:
                summary: Acknowledge two alert episodes
                value:
                  items:
                    - episode_id: episode-1
                    - episode_id: episode-2
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkAckEpisodeActionResponse:
                  summary: 'One action created, one episode not found'
                  value:
                    affected_count: 1
                    errors:
                      - error:
                          code: ALERT_EPISODE_NOT_FOUND
                          message: 'Alert episode with episode_id [episode-2] not found'
                        id: episode-2
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/episodes/_bulk_activate:
    post:
      tags:
        - alerting-v2
      summary: Bulk activate alert episodes
      description: 'Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-bulk-activate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_activate_episodes_request'
            examples:
              bulkActivateEpisodeActionRequest:
                summary: Reopen an alert episode with a reason
                value:
                  items:
                    - episode_id: episode-1
                      reason: manual reopen
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkActivateEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 1
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/episodes/_bulk_assign:
    post:
      tags:
        - alerting-v2
      summary: Bulk assign alert episodes
      description: 'Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-bulk-assign
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_assign_episodes_request'
            examples:
              bulkAssignEpisodeActionRequest:
                summary: Assign one episode and clear the assignee of another
                value:
                  items:
                    - assignee_uid: u_abc123
                      episode_id: episode-1
                    - assignee_uid: 'null'
                      episode_id: episode-2
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkAssignEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/episodes/_bulk_deactivate:
    post:
      tags:
        - alerting-v2
      summary: Bulk deactivate alert episodes
      description: 'Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-bulk-deactivate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_deactivate_episodes_request'
            examples:
              bulkDeactivateEpisodeActionRequest:
                summary: Close an alert episode with a reason
                value:
                  items:
                    - episode_id: episode-1
                      reason: false positive
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkDeactivateEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 1
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/episodes/_bulk_tag:
    post:
      tags:
        - alerting-v2
      summary: Bulk tag alert episodes
      description: 'Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-bulk-tag
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_tag_episodes_request'
            examples:
              bulkTagEpisodeActionRequest:
                summary: Tag two alert episodes with production
                value:
                  items:
                    - episode_id: episode-1
                      tags:
                        - production
                    - episode_id: episode-2
                      tags:
                        - production
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkTagEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/episodes/_bulk_unack:
    post:
      tags:
        - alerting-v2
      summary: Bulk unacknowledge alert episodes
      description: 'Create the same action for multiple alert episodes in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-bulk-unack
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unack_episodes_request'
            examples:
              bulkUnackEpisodeActionRequest:
                summary: Unacknowledge two alert episodes
                value:
                  items:
                    - episode_id: episode-1
                    - episode_id: episode-2
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkUnackEpisodeActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/episodes/{episode_id}/_ack':
    post:
      tags:
        - alerting-v2
      summary: Acknowledge an alert episode
      description: 'Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-episode-id-ack
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: episode_id
          in: path
          description: Identifier of the alert episode to apply the action to.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_ack_episode_action'
            examples:
              createAckEpisodeActionRequest:
                summary: Acknowledge the alert episode
                value: { }
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required episode_id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        episode_id:
                          - Required
                    error: Bad Request
                    message: 'episode_id: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: 'Indicates the alert episode was not found, or is not the latest episode of its series (activate and deactivate only).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertEpisodeNotFound:
                  summary: No alert episode exists for the given episode_id
                  value:
                    code: ALERT_EPISODE_NOT_FOUND
                    details:
                      episode_id: episode-1
                    error: Not Found
                    message: 'Alert episode with episode_id [episode-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/episodes/{episode_id}/_activate':
    post:
      tags:
        - alerting-v2
      summary: Activate an alert episode
      description: 'Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-episode-id-activate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: episode_id
          in: path
          description: Identifier of the alert episode to apply the action to.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_activate_episode_action'
            examples:
              createActivateEpisodeActionRequest:
                summary: Activate with a reason
                value:
                  reason: Issue reappeared after silence window.
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required episode_id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        episode_id:
                          - Required
                    error: Bad Request
                    message: 'episode_id: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: 'Indicates the alert episode was not found, or is not the latest episode of its series (activate and deactivate only).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertEpisodeNotFound:
                  summary: No alert episode exists for the given episode_id
                  value:
                    code: ALERT_EPISODE_NOT_FOUND
                    details:
                      episode_id: episode-1
                    error: Not Found
                    message: 'Alert episode with episode_id [episode-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/episodes/{episode_id}/_assign':
    post:
      tags:
        - alerting-v2
      summary: Assign an alert episode to a user
      description: 'Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-episode-id-assign
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: episode_id
          in: path
          description: Identifier of the alert episode to apply the action to.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_assign_episode_action'
            examples:
              createAssignEpisodeActionRequest:
                summary: Assign the alert episode to user u_abc123
                value:
                  assignee_uid: u_abc123
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required episode_id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        episode_id:
                          - Required
                    error: Bad Request
                    message: 'episode_id: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: 'Indicates the alert episode was not found, or is not the latest episode of its series (activate and deactivate only).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertEpisodeNotFound:
                  summary: No alert episode exists for the given episode_id
                  value:
                    code: ALERT_EPISODE_NOT_FOUND
                    details:
                      episode_id: episode-1
                    error: Not Found
                    message: 'Alert episode with episode_id [episode-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/episodes/{episode_id}/_deactivate':
    post:
      tags:
        - alerting-v2
      summary: Deactivate an alert episode
      description: 'Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-episode-id-deactivate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: episode_id
          in: path
          description: Identifier of the alert episode to apply the action to.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_deactivate_episode_action'
            examples:
              createDeactivateEpisodeActionRequest:
                summary: Deactivate as a false positive
                value:
                  reason: False positive confirmed by on-call.
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required episode_id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        episode_id:
                          - Required
                    error: Bad Request
                    message: 'episode_id: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: 'Indicates the alert episode was not found, or is not the latest episode of its series (activate and deactivate only).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertEpisodeNotFound:
                  summary: No alert episode exists for the given episode_id
                  value:
                    code: ALERT_EPISODE_NOT_FOUND
                    details:
                      episode_id: episode-1
                    error: Not Found
                    message: 'Alert episode with episode_id [episode-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/episodes/{episode_id}/_tag':
    post:
      tags:
        - alerting-v2
      summary: Tag an alert episode
      description: 'Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-episode-id-tag
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: episode_id
          in: path
          description: Identifier of the alert episode to apply the action to.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_tag_episode_action'
            examples:
              createTagEpisodeActionRequest:
                summary: Tag the alert episode with production and investigating
                value:
                  tags:
                    - production
                    - investigating
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required episode_id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        episode_id:
                          - Required
                    error: Bad Request
                    message: 'episode_id: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: 'Indicates the alert episode was not found, or is not the latest episode of its series (activate and deactivate only).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertEpisodeNotFound:
                  summary: No alert episode exists for the given episode_id
                  value:
                    code: ALERT_EPISODE_NOT_FOUND
                    details:
                      episode_id: episode-1
                    error: Not Found
                    message: 'Alert episode with episode_id [episode-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/episodes/{episode_id}/_unack':
    post:
      tags:
        - alerting-v2
      summary: Unacknowledge an alert episode
      description: 'Create an action for a specific alert episode.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-episodes-episode-id-unack
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: episode_id
          in: path
          description: Identifier of the alert episode to apply the action to.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_unack_episode_action'
            examples:
              createUnackEpisodeActionRequest:
                summary: Unacknowledge the alert episode
                value: { }
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required episode_id
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        episode_id:
                          - Required
                    error: Bad Request
                    message: 'episode_id: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: 'Indicates the alert episode was not found, or is not the latest episode of its series (activate and deactivate only).'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertEpisodeNotFound:
                  summary: No alert episode exists for the given episode_id
                  value:
                    code: ALERT_EPISODE_NOT_FOUND
                    details:
                      episode_id: episode-1
                    error: Not Found
                    message: 'Alert episode with episode_id [episode-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/execution_history/action_policies:
    get:
      tags:
        - alerting-v2
      summary: List action policy executions
      description: 'Get a paginated list of dispatcher summary events for action policies in the current space.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-execution-history.'
      operationId: get-alerting-v2-execution-history-action-policies
      parameters:
        - name: page
          in: query
          description: Page number (1-indexed). Defaults to 1.
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - name: per_page
          in: query
          description: Number of events per page. Defaults to 20. Pass 0 for a count-only read.
          schema:
            maximum: 100
            minimum: 0
            type: integer
        - name: start_date
          in: query
          description: Inclusive ISO datetime lower bound on the event timestamp; overrides the default 24-hour window. Independent of episode_ids — e.g. set it to an episode’s start time to scope results to that episode’s lifetime.
          schema:
            pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
            type: string
            format: date-time
        - name: episode_ids
          in: query
          description: Episode filter. Narrows events to those referencing at least one of the provided episode ids.
          schema:
            maxItems: 50
            minItems: 1
            type: array
            items:
              maxLength: 150
              minLength: 1
              type: string
        - name: search
          in: query
          description: 'Free-text search. Matches policy name, rule name, policy/rule ID (case-insensitive).'
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - name: rule_ids
          in: query
          description: Explicit rule filter. Narrows events to those referencing at least one of the provided rule ids. Also unions with the search filter if both are provided.
          schema:
            maxItems: 50
            minItems: 1
            type: array
            items:
              maxLength: 150
              minLength: 1
              type: string
        - name: outcome
          in: query
          description: 'Outcome filter. When omitted matches all outcomes. Pass one or more of "dispatched", "throttled", "dispatch_failed" to narrow.'
          schema:
            maxItems: 3
            minItems: 1
            type: array
            items:
              enum:
                - dispatched
                - throttled
                - dispatch_failed
              type: string
      responses:
        '200':
          description: Returns a paginated list of execution history events.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_response'
              examples:
                listActionPolicyExecutionsResponse:
                  summary: A page of action policy execution events
                  value:
                    items:
                      - action_group_count: 1
                        dispatched_at: '2026-01-15T12:05:00.000Z'
                        episode_count: 1
                        episodes:
                          - id: episode-1
                        outcome: dispatched
                        policy:
                          id: action-policy-1
                          name: Notify on production alerts
                        rules:
                          - id: rule-1
                            name: Host CPU high
                        total_rule_count: 1
                        workflows:
                          - id: workflow-1
                            name: Notify oncall
                    page: 1
                    per_page: 20
                    search_matches: 'null'
                    total_events: 1
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                          - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/execution_history/rules:
    get:
      tags:
        - alerting-v2
      summary: List rule executions
      description: 'Get a paginated list of rule execution events.<br/><br/>[Required authorization] Route required privileges: read_alerting-v2-execution-history.'
      operationId: get-alerting-v2-execution-history-rules
      parameters:
        - name: rule_ids
          in: query
          description: 'Rule id filter. '
          schema:
            maxItems: 50
            minItems: 1
            type: array
            items:
              maxLength: 150
              minLength: 1
              type: string
        - name: outcome
          in: query
          description: 'Outcome filter. '
          schema:
            maxItems: 2
            minItems: 1
            type: array
            items:
              enum:
                - success
                - failure
              type: string
        - name: from
          in: query
          description: Inclusive ISO datetime lower bound on event.start.
          schema:
            pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
            type: string
            format: date-time
        - name: to
          in: query
          description: Inclusive ISO datetime upper bound on event.start.
          schema:
            pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
            type: string
            format: date-time
        - name: sort
          in: query
          description: Sort field. Defaults to started_at.
          required: true
          schema:
            enum:
              - started_at
              - duration
            type: string
            default: started_at
        - name: sort_order
          in: query
          description: Sort direction.
          required: true
          schema:
            enum:
              - asc
              - desc
            type: string
            default: desc
        - name: page
          in: query
          description: Page number.
          required: true
          schema:
            maximum: 10000
            minimum: 1
            type: integer
            default: 1
        - name: per_page
          in: query
          description: Number of results per page.
          required: true
          schema:
            maximum: 100
            minimum: 1
            type: integer
            default: 20
      responses:
        '200':
          description: Returns a paginated list of rule execution events.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_executions_response'
              examples:
                listRuleExecutionsResponse:
                  summary: One successful rule execution
                  value:
                    items:
                      - ended_at: '2026-01-15T12:00:01.250Z'
                        error: 'null'
                        id: execution-1
                        outcome: success
                        reason: 'null'
                        rule:
                          id: rule-1
                          version: 3
                        space_id: default
                        started_at: '2026-01-15T12:00:00.000Z'
                        timings:
                          duration: 1250
                          scheduled_delay: 40
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Exceeds the max result window
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        page:
                          - page * per_page cannot exceed 10000.
                    error: Bad Request
                    message: page * per_page cannot exceed 10000.
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules:
    get:
      tags:
        - alerting-v2
      summary: List rules
      description: '[Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules
      parameters:
        - name: page
          in: query
          description: The page number to return. Defaults to 1. `page * per_page` cannot exceed 10000.
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - name: per_page
          in: query
          description: The number of rules to return per page. Defaults to 20.
          schema:
            maximum: 1000
            minimum: 1
            type: integer
        - name: filter
          in: query
          description: The filter to apply to the rules.
          schema:
            maxLength: 4096
            type: string
        - name: sort_field
          in: query
          description: The field to sort rules by.
          schema:
            enum:
              - kind
              - enabled
              - name
            type: string
        - name: sort_order
          in: query
          description: The direction to sort rules.
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: search
          in: query
          description: A text string to search across rule fields.
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns a paginated list of rules.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_list_response'
              examples:
                listRulesResponse:
                  summary: Paginated list containing one matching rule
                  value:
                    items:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        grouping:
                          fields:
                            - host.name
                        id: rule-1
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high
                          tags:
                            - production
                            - infra
                          version: 1
                        query:
                          breach:
                            query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          format: standalone
                        recovery_strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending_count: 1
                          recovering_count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by: elastic
                        version: WzAsMV0=
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - alerting-v2
      summary: Create a rule
      description: 'Creates a rule with a server-generated identifier. To create or replace a rule with a client-supplied identifier, use PUT /api/alerting/v2/rules/{id}/.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule'
            examples:
              createRuleRequest:
                summary: Create a host CPU threshold rule
                value:
                  grouping:
                    fields:
                      - host.name
                  kind: alert
                  metadata:
                    description: Alerts when average CPU usage exceeds a threshold.
                    name: Host CPU high
                    tags:
                      - production
                      - infra
                  query:
                    breach:
                      query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                    format: standalone
                  recovery_strategy: no_breach
                  schedule:
                    every: 1m
                    lookback: 5m
                  state_transition:
                    pending_count: 1
                    recovering_count: 1
                  time_field: '@timestamp'
      responses:
        '201':
          description: Returns the newly created rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                createRuleResponse:
                  summary: Created host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Missing required rule metadata
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        metadata:
                          - Required
                    error: Bad Request
                    message: 'metadata: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_create:
    post:
      tags:
        - alerting-v2
      summary: Create rules in bulk
      description: 'Creates up to 100 rules in a single request. Each item can include a client-supplied `id`. Kibana generates an identifier when `id` is omitted. The request succeeds with HTTP 200 even when some rules fail. Created rules are returned in `rules`. Failures are returned in `errors`. Check `errors` before treating the request as fully successful. To create a single rule, use POST /api/alerting/v2/rules.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-create
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rules_request'
            examples:
              bulkCreateRulesRequest:
                summary: 'Create two rules, one of them disabled'
                value:
                  rules:
                    - grouping:
                        fields:
                          - host.name
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU high
                        tags:
                          - production
                          - infra
                      query:
                        breach:
                          query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        format: standalone
                      recovery_strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending_count: 1
                        recovering_count: 1
                      time_field: '@timestamp'
                    - enabled: false
                      grouping:
                        fields:
                          - host.name
                      id: rule-disabled
                      kind: alert
                      metadata:
                        description: Alerts when average CPU usage exceeds a threshold.
                        name: Host CPU high (disabled)
                        tags:
                          - production
                          - infra
                      query:
                        breach:
                          query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                        format: standalone
                      recovery_strategy: no_breach
                      schedule:
                        every: 1m
                        lookback: 5m
                      state_transition:
                        pending_count: 1
                        recovering_count: 1
                      time_field: '@timestamp'
      responses:
        '200':
          description: Created rules are returned in `rules`. Failures are returned in `errors`.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rules_response'
              examples:
                bulkCreateRulesResponse:
                  summary: Created both requested rules
                  value:
                    errors: [ ]
                    rules:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        grouping:
                          fields:
                            - host.name
                        id: rule-1
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high
                          tags:
                            - production
                            - infra
                          version: 1
                        query:
                          breach:
                            query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          format: standalone
                        recovery_strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending_count: 1
                          recovering_count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by: elastic
                        version: WzAsMV0=
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by: elastic
                        enabled: false
                        grouping:
                          fields:
                            - host.name
                        id: rule-disabled
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high (disabled)
                          tags:
                            - production
                            - infra
                          version: 1
                        query:
                          breach:
                            query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          format: standalone
                        recovery_strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending_count: 1
                          recovering_count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by: elastic
                        version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Request body is missing required rules
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        rules:
                          - Required
                    error: Bad Request
                    message: 'rules: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_delete:
    post:
      tags:
        - alerting-v2
      summary: Delete rules in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-delete
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkDeleteRulesRequest:
                summary: Delete two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
      responses:
        '200':
          description: Returns the result of the bulk delete operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkDeleteRulesResponse:
                  summary: Deleted both requested rules
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_disable:
    post:
      tags:
        - alerting-v2
      summary: Disable rules in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkDisableRulesRequest:
                summary: Disable two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
      responses:
        '200':
          description: Returns the result of the bulk disable operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkDisableRulesResponse:
                  summary: Disabled both requested rules
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_enable:
    post:
      tags:
        - alerting-v2
      summary: Enable rules in bulk by ID
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkEnableRulesRequest:
                summary: Enable two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
      responses:
        '200':
          description: Returns the result of the bulk enable operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkEnableRulesResponse:
                  summary: Enabled both requested rules
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_get:
    post:
      tags:
        - alerting-v2
      summary: Get rules in bulk
      description: '[Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-get
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkGetRulesRequest:
                summary: Fetch two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
      responses:
        '200':
          description: Returns the requested rules.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_get_rules_response'
              examples:
                bulkGetRulesResponse:
                  summary: Returned the requested rules
                  value:
                    rules:
                      - created_at: '2026-01-15T12:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        grouping:
                          fields:
                            - host.name
                        id: rule-1
                        kind: alert
                        metadata:
                          description: Alerts when average CPU usage exceeds a threshold.
                          name: Host CPU high
                          tags:
                            - production
                            - infra
                          version: 1
                        query:
                          breach:
                            query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                          format: standalone
                        recovery_strategy: no_breach
                        schedule:
                          every: 1m
                          lookback: 5m
                        state_transition:
                          pending_count: 1
                          recovering_count: 1
                        time_field: '@timestamp'
                        updated_at: '2026-01-15T12:00:00.000Z'
                        updated_by: elastic
                        version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: One or more rule ids could not be found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                rulesNotFound:
                  summary: One or more requested rule ids could not be found
                  value:
                    code: NOT_FOUND
                    error: Not Found
                    message: 'Saved object [alerting_rule/rule-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_bulk_update_api_key:
    post:
      tags:
        - alerting-v2
      summary: Update the API key of rules in bulk by ID
      description: 'Rotates each rule executor task API key to one derived from the current user’s credentials.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-bulk-update-api-key
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_ids_request'
            examples:
              bulkUpdateApiKeyRequest:
                summary: Rotate API keys for two rules by ID
                value:
                  ids:
                    - rule-1
                    - rule-2
      responses:
        '200':
          description: Returns the result of the bulk update API key operation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkUpdateApiKeyResponse:
                  summary: Rotated API keys for both requested rules
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Request body is missing required rule ids
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        ids:
                          - Required
                    error: Bad Request
                    message: 'ids: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_delete_by_query:
    post:
      tags:
        - alerting-v2
      summary: Delete rules matching a query (dry-run by default)
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-delete-by-query
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
            examples:
              deleteRulesByQueryRequest:
                summary: 'Delete rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
      responses:
        '200':
          description: 'Returns a dry-run preview by default, or the executed operation when `force` is true.'
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                deleteRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: 'By-query body omits filter, search, and match_all'
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - 'At least one of filter, search, or match_all must be provided.'
                    error: Bad Request
                    message: 'At least one of filter, search, or match_all must be provided.'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_disable_by_query:
    post:
      tags:
        - alerting-v2
      summary: Disable rules matching a query (dry-run by default)
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-disable-by-query
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
            examples:
              disableRulesByQueryRequest:
                summary: 'Disable rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
      responses:
        '200':
          description: 'Returns a dry-run preview by default, or the executed operation when `force` is true.'
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                disableRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: 'By-query body omits filter, search, and match_all'
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - 'At least one of filter, search, or match_all must be provided.'
                    error: Bad Request
                    message: 'At least one of filter, search, or match_all must be provided.'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_enable_by_query:
    post:
      tags:
        - alerting-v2
      summary: Enable rules matching a query (dry-run by default)
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-enable-by-query
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
            examples:
              enableRulesByQueryRequest:
                summary: 'Enable rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
      responses:
        '200':
          description: 'Returns a dry-run preview by default, or the executed operation when `force` is true.'
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                enableRulesByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: 'By-query body omits filter, search, and match_all'
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - 'At least one of filter, search, or match_all must be provided.'
                    error: Bad Request
                    message: 'At least one of filter, search, or match_all must be provided.'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/rules/_update_api_key_by_query:
    post:
      tags:
        - alerting-v2
      summary: Update the API key of rules matching a query (dry-run by default)
      description: 'Rotates each matching rule executor task API key to one derived from the current user’s credentials.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-update-api-key-by-query
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_by_query_request'
            examples:
              updateApiKeyByQueryRequest:
                summary: 'Rotate API keys for rules tagged production (dry-run by default, or set `force: true` to execute)'
                value:
                  filter: 'tags: production'
      responses:
        '200':
          description: 'Returns a dry-run preview by default, or the executed operation when `force` is true.'
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_dry_run_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                updateApiKeyByQueryDryRunResponse:
                  summary: 'Dry-run preview of matching rules; set `force: true` on the request to execute'
                  value:
                    match_count: 2
                    sample:
                      - rule-1
                      - rule-2
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: 'By-query body omits filter, search, and match_all'
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        '':
                          - 'At least one of filter, search, or match_all must be provided.'
                    error: Bad Request
                    message: 'At least one of filter, search, or match_all must be provided.'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/rules/{id}':
    delete:
      tags:
        - alerting-v2
      summary: Delete a rule
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: delete-alerting-v2-rules-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '204':
          description: The rule was deleted successfully.
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates a rule with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - alerting-v2
      summary: Get a rule
      description: '[Required authorization] Route required privileges: read_alerting-v2-rules.'
      operationId: get-alerting-v2-rules-id
      parameters:
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the requested rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                getRuleResponse:
                  summary: Retrieved host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates a rule with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - alerting-v2
      summary: Update a rule
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: patch-alerting-v2-rules-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_update_rule'
            examples:
              updateRuleRequest:
                summary: Update a rule name and description
                value:
                  metadata:
                    description: Updated description.
                    name: Host CPU high (updated)
                  version: WzAsMV0=
      responses:
        '200':
          description: Returns the updated rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                updateRuleResponse:
                  summary: Updated rule metadata
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Updated description.
                      name: Host CPU high (updated)
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Update body includes an unrecognized field
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        unknownField:
                          - Unrecognized key
                    error: Bad Request
                    message: 'Unrecognized key(s) in object: ''unknownField'''
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates a rule with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
        '409':
          description: Indicates the rule was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - alerting-v2
      summary: Create or replace a rule
      description: 'Creates a rule with the given identifier, or fully replaces it if one already exists.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: put-alerting-v2-rules-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_rule'
            examples:
              upsertRuleRequest:
                summary: Create or replace a host CPU threshold rule
                value:
                  grouping:
                    fields:
                      - host.name
                  kind: alert
                  metadata:
                    description: Alerts when average CPU usage exceeds a threshold.
                    name: Host CPU high
                    tags:
                      - production
                      - infra
                  query:
                    breach:
                      query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                    format: standalone
                  recovery_strategy: no_breach
                  schedule:
                    every: 1m
                    lookback: 5m
                  state_transition:
                    pending_count: 1
                    recovering_count: 1
                  time_field: '@timestamp'
      responses:
        '200':
          description: Returns the replaced rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                upsertRuleReplacedResponse:
                  summary: Replaced an existing rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '201':
          description: Returns the newly created rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                upsertRuleCreatedResponse:
                  summary: Created a new rule with the given ID
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Upsert body is missing required rule metadata
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        metadata:
                          - Required
                    error: Bad Request
                    message: 'metadata: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '409':
          description: 'Indicates the rule was created or updated concurrently, or the request changes immutable fields.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleVersionConflict:
                  summary: Rule was changed concurrently by another caller
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/rules/{id}/_disable':
    post:
      tags:
        - alerting-v2
      summary: Disable a rule
      description: 'Disable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-id-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the disabled rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                disableRuleResponse:
                  summary: Disabled host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: false
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: Indicates the request failed schema validation.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Indicates an invalid schema or parameters.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        errors: [ ]
                        properties:
                          page:
                            errors:
                              - 'Too small: expected number to be >=1'
                    error: Bad Request
                    message: 'page: Too small: expected number to be >=1'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates a rule with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
        '409':
          description: Indicates the rule was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/rules/{id}/_enable':
    post:
      tags:
        - alerting-v2
      summary: Enable a rule
      description: 'Enable a rule by identifier.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-id-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '200':
          description: Returns the enabled rule.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
              examples:
                enableRuleResponse:
                  summary: Enabled host CPU threshold rule
                  value:
                    created_at: '2026-01-15T12:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    grouping:
                      fields:
                        - host.name
                    id: rule-1
                    kind: alert
                    metadata:
                      description: Alerts when average CPU usage exceeds a threshold.
                      name: Host CPU high
                      tags:
                        - production
                        - infra
                      version: 1
                    query:
                      breach:
                        query: FROM metrics-* | WHERE host.cpu.usage > 0.9 | STATS avg_cpu = AVG(host.cpu.usage) BY host.name
                      format: standalone
                    recovery_strategy: no_breach
                    schedule:
                      every: 1m
                      lookback: 5m
                    state_transition:
                      pending_count: 1
                      recovering_count: 1
                    time_field: '@timestamp'
                    updated_at: '2026-01-15T12:00:00.000Z'
                    updated_by: elastic
                    version: WzAsMV0=
        '400':
          description: 'Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                maxSchedulesPerMinuteExceeded:
                  summary: 'Indicates the request is invalid, for example enabling the rule would exceed the configured schedule limit.'
                  value:
                    code: MAX_SCHEDULES_PER_MINUTE_EXCEEDED
                    details:
                      interval: 1m
                      maxScheduledPerMinute: 400
                    error: Bad Request
                    message: Rule schedule of "1m" would exceed the limit of 400 rule runs per minute
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates a rule with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
        '409':
          description: Indicates the rule was concurrently updated by another caller.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleVersionConflict:
                  summary: Indicates the rule was concurrently updated by another caller.
                  value:
                    code: RULE_VERSION_CONFLICT
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" has already been updated by another user
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/rules/{id}/_run':
    post:
      tags:
        - alerting-v2
      summary: Run a rule now
      description: '[Required authorization] Route required privileges: manage_alerting-v2-rules.'
      operationId: post-alerting-v2-rules-id-run
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the rule.
          required: true
          schema:
            maxLength: 150
            minLength: 1
            type: string
      responses:
        '202':
          description: The rule run was triggered successfully.
        '400':
          description: Indicates the rule is disabled and cannot be run.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleDisabled:
                  summary: Indicates the rule is disabled and cannot be run.
                  value:
                    code: RULE_DISABLED
                    details:
                      rule_id: rule-1
                    error: Bad Request
                    message: Rule with id "rule-1" is disabled and cannot be run
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates a rule with the given ID does not exist.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleNotFound:
                  summary: No rule exists for the given ID
                  value:
                    code: RULE_NOT_FOUND
                    details:
                      rule_id: rule-1
                    error: Not Found
                    message: Rule with id "rule-1" not found
        '409':
          description: Indicates the rule is already running or the run request conflicted.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                ruleAlreadyRunning:
                  summary: Indicates the rule is already running or the run request conflicted.
                  value:
                    code: RULE_ALREADY_RUNNING
                    details:
                      rule_id: rule-1
                    error: Conflict
                    message: Rule with id "rule-1" is already running
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/series/_bulk_snooze:
    post:
      tags:
        - alerting-v2
      summary: Bulk snooze alert episode series
      description: 'Create the same action for multiple alert episode series in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-series-bulk-snooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_snooze_series_request'
            examples:
              bulkSnoozeSeriesActionRequest:
                summary: Snooze one series until a date and one indefinitely
                value:
                  items:
                    - expiry: '2026-01-16T12:00:00.000Z'
                      group_hash: group-hash-1
                    - group_hash: group-hash-2
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkSnoozeSeriesActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/alerting/v2/series/_bulk_unsnooze:
    post:
      tags:
        - alerting-v2
      summary: Bulk unsnooze alert episode series
      description: 'Create the same action for multiple alert episode series in a single request.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-series-bulk-unsnooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unsnooze_series_request'
            examples:
              bulkUnsnoozeSeriesActionRequest:
                summary: Clear the snooze on two alert episode series
                value:
                  items:
                    - group_hash: group-hash-1
                    - group_hash: group-hash-2
      responses:
        '200':
          description: Returns the number of created actions and per-item errors for actions that were not created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_operation_response'
              examples:
                bulkUnsnoozeSeriesActionResponse:
                  summary: All actions created
                  value:
                    affected_count: 2
                    errors: [ ]
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Items list is empty
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        items:
                          - At least one action must be provided
                    error: Bad Request
                    message: 'items: At least one action must be provided'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/series/{group_hash}/_snooze':
    post:
      tags:
        - alerting-v2
      summary: Snooze an alert episode series
      description: 'Create an action for a specific alert episode series.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-series-group-hash-snooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: group_hash
          in: path
          description: Hash identifying the alert episode series to apply the action to.
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_snooze_series_action'
            examples:
              createSnoozeSeriesActionRequest:
                summary: Snooze until 2026-01-16T12:00:00.000Z
                value:
                  expiry: '2026-01-16T12:00:00.000Z'
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                          - Required
                    error: Bad Request
                    message: 'group_hash: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates the alert episode series was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertSeriesNotFound:
                  summary: No alert episode series exists for the given group_hash
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      group_hash: group-hash-1
                    error: Not Found
                    message: 'Alert series with group_hash [group-hash-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/alerting/v2/series/{group_hash}/_unsnooze':
    post:
      tags:
        - alerting-v2
      summary: Unsnooze an alert episode series
      description: 'Create an action for a specific alert episode series.<br/><br/>[Required authorization] Route required privileges: manage_alerting-v2-alerts.'
      operationId: post-alerting-v2-series-group-hash-unsnooze
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: group_hash
          in: path
          description: Hash identifying the alert episode series to apply the action to.
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_new_unsnooze_series_action'
            examples:
              createUnsnoozeSeriesActionRequest:
                summary: Clear the current snooze
                value: { }
      responses:
        '204':
          description: Indicates the action was created.
        '400':
          description: Indicates an invalid schema or parameters.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                invalidRequest:
                  summary: Path is missing required group_hash.
                  value:
                    code: BAD_REQUEST
                    details:
                      errors:
                        group_hash:
                          - Required
                    error: Bad Request
                    message: 'group_hash: Required'
        '401':
          description: Indicates the request was not authenticated.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                unauthorized:
                  summary: Request was not authenticated
                  value:
                    code: UNAUTHORIZED
                    error: Unauthorized
                    message: Authentication required to access this API.
        '403':
          description: Indicates the user does not have the required privileges to perform the request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                forbidden:
                  summary: Caller lacks required privileges
                  value:
                    code: FORBIDDEN
                    error: Forbidden
                    message: The current user does not have the required privileges for this request.
        '404':
          description: Indicates the alert episode series was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertSeriesNotFound:
                  summary: No alert episode series exists for the given group_hash
                  value:
                    code: ALERT_EVENT_NOT_FOUND
                    details:
                      group_hash: group-hash-1
                    error: Not Found
                    message: 'Alert series with group_hash [group-hash-1] not found'
        '500':
          description: Indicates an unexpected server-side error.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                internalServerError:
                  summary: Unexpected server-side error
                  value:
                    code: INTERNAL_SERVER_ERROR
                    error: Internal Server Error
                    message: An unexpected error occurred.
        '503':
          description: Indicates the alerting engine is disabled by the `alerting:v2:enabled` advanced setting.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_error_response'
              examples:
                alertingDisabled:
                  summary: Alerting V2 is disabled
                  value:
                    code: ALERTING_DISABLED
                    error: Service Unavailable
                    message: Alerting is disabled.
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/agent_keys:
    post:
      tags:
        - APM agent keys
      summary: Create an APM agent key
      description: "Create a new agent key for APM.\nThe user creating an APM agent API key must have at least the `manage_own_api_key` cluster privilege and the APM application-level privileges that it wishes to grant.\nAfter it is created, you can copy the API key (Base64 encoded) and use it to to authorize requests from APM agents to the APM Server.\n"
      operationId: createAgentKey
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APM_UI_agent_keys_object'
            examples:
              createAgentKeyRequest1:
                $ref: '#/components/examples/APM_UI_agent_keys_object_post_request1'
        required: true
      responses:
        '200':
          description: Agent key created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_agent_keys_response'
              examples:
                createAgentKeyResponse1:
                  $ref: '#/components/examples/APM_UI_agent_keys_object_post_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '500':
          description: Internal Server Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/fleet/apm_server_schema:
    post:
      tags:
        - APM server schema
      summary: Save APM server schema
      description: "DEPRECATED: This endpoint is intended for internal use by Fleet integrations to push the APM Server configuration schema. Do not use for new integrations. It stores the provided schema object as a Kibana saved object. If Fleet migration is not available on the current deployment, the API returns a 404.\n"
      operationId: saveApmServerSchema
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                schema:
                  type: object
                  description: Schema object
                  example:
                    foo: bar
            examples:
              saveApmServerSchemaRequest:
                description: An example request payload for `POST /api/apm/fleet/apm_server_schema`.
                value:
                  schema:
                    foo: bar
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                description: The response body is intentionally empty for this endpoint.
              examples:
                saveApmServerSchemaResponseExample1:
                  $ref: '#/components/examples/APM_UI_fleet_apm_server_schema_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/apm/services/{serviceName}/annotation':
    post:
      tags:
        - APM annotations
      summary: Create a service annotation
      description: Create a new annotation for a specific service.
      operationId: createAnnotation
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
        - name: serviceName
          in: path
          description: The name of the service
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APM_UI_create_annotation_object'
            examples:
              createAnnotationRequest1:
                $ref: '#/components/examples/APM_UI_annotation_object_post_request1'
        required: true
      responses:
        '200':
          description: Annotation created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_create_annotation_response'
              examples:
                createAnnotationResponse1:
                  $ref: '#/components/examples/APM_UI_annotation_object_post_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-codeSamples:
        - lang: Curl
          source: "curl -X POST \\\nhttp://localhost:5601/api/apm/services/opbeans-java/annotation \\\n-H 'Content-Type: application/json' \\\n-H 'kbn-xsrf: true' \\\n-H 'Authorization: Basic YhUlubWZhM0FDbnlQeE6WRtaW49FQmSGZ4RUWXdX' \\\n-d '{\n    \"@timestamp\": \"2020-05-08T10:31:30.452Z\",\n    \"service\": {\n        \"version\": \"1.2\"\n    },\n    \"message\": \"Deployment 1.2\"\n    }'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/apm/services/{serviceName}/annotation/search':
    get:
      tags:
        - APM annotations
      summary: Search for annotations
      description: Search for annotations related to a specific service.
      operationId: getAnnotation
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - name: serviceName
          in: path
          description: The name of the service
          required: true
          schema:
            type: string
        - name: environment
          in: query
          description: The environment to filter annotations by
          schema:
            type: string
        - name: start
          in: query
          description: The start date for the search
          schema:
            type: string
            format: date-time
          example: '2024-01-01T00:00:00.000Z'
        - name: end
          in: query
          description: The end date for the search
          schema:
            type: string
            format: date-time
          example: '2024-01-31T23:59:59.999Z'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_annotation_search_response'
              examples:
                getAnnotationResponse1:
                  $ref: '#/components/examples/APM_UI_annotation_search_get_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '500':
          description: Internal Server Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration:
    delete:
      tags:
        - APM agent configuration
      summary: Delete agent configuration
      description: "Delete an existing agent configuration. You must have `all` privileges for the APM and User Experience feature in Kibana. When successful, the configuration is removed and, if Fleet is enabled, APM package policies are synchronized accordingly.\n"
      operationId: deleteAgentConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APM_UI_delete_service_object'
            examples:
              deleteAgentConfigurationRequest1:
                $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_delete_request1'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_delete_agent_configurations_response'
              examples:
                deleteAgentConfigurationResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_delete_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - APM agent configuration
      summary: Get a list of agent configurations
      description: "Retrieve all agent configurations. You must have `read` privileges for the APM and User Experience feature in Kibana. If agent configuration is not available on the current deployment, the API returns a 404.\n"
      operationId: getAgentConfigurations
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_agent_configurations_response'
              examples:
                getAgentConfigurationsResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_get_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - APM agent configuration
      summary: Create or update agent configuration
      description: "Create or update an agent configuration. You must have `all` privileges for the APM and User Experience feature in Kibana. When updating an existing configuration, the `?overwrite=true` query parameter is required. If the configuration already exists and `overwrite` is not set to `true`, the API returns a 400 error. When successful and Fleet is enabled, APM package policies are synchronized accordingly.\n"
      operationId: createUpdateAgentConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
        - name: overwrite
          in: query
          description: If the config exists ?overwrite=true is required
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APM_UI_agent_configuration_intake_object'
            examples:
              createUpdateAgentConfigurationRequestExample1:
                $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_put_request1'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                description: The response body is intentionally empty for this endpoint.
              examples:
                createUpdateAgentConfigurationResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_put_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/agent_name:
    get:
      tags:
        - APM agent configuration
      summary: Get agent name for service
      description: Retrieve `agentName` for a service.
      operationId: getAgentNameForService
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - name: serviceName
          in: query
          description: The name of the service
          required: true
          schema:
            type: string
          example: node
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_service_agent_name_response'
              examples:
                getAgentNameForServiceResponse1:
                  $ref: '#/components/examples/APM_UI_service_agent_name_get_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/environments:
    get:
      tags:
        - APM agent configuration
      summary: Get environments for service
      description: "Retrieve the available environments for a given service, to be used in agent configuration. You must have `read` privileges for the APM and User Experience feature in Kibana. If `serviceName` is omitted, environments across all services are returned.\n"
      operationId: getEnvironmentsForService
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - name: serviceName
          in: query
          description: 'The name of the service. If omitted, environments across all services are returned.'
          schema:
            type: string
          example: opbeans-node
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_service_environments_response'
              examples:
                getEnvironmentsForServiceResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_environments_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/search:
    post:
      tags:
        - APM agent configuration
      summary: Lookup single agent configuration
      description: "DEPRECATED: This endpoint is intended for internal use by APM agents to fetch their configuration and mark it as applied. Do not use for new integrations. It searches for a single agent configuration matching the given service, and optionally updates the `applied_by_agent` field when the provided `etag` matches the current configuration.\n"
      operationId: searchSingleConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/APM_UI_search_agent_configuration_object'
            examples:
              searchSingleConfigurationRequest1:
                $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_search_request1'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_search_agent_configuration_response'
              examples:
                searchSingleConfigurationResponse1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_search_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/settings/agent-configuration/view:
    get:
      tags:
        - APM agent configuration
      summary: Get single agent configuration
      description: "Retrieve a single agent configuration matching the given service name and environment. You must have `read` privileges for the APM and User Experience feature in Kibana. If no matching configuration is found, the API returns a 404.\n"
      operationId: getSingleAgentConfiguration
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - name: name
          in: query
          description: Service name
          schema:
            type: string
          example: node
        - name: environment
          in: query
          description: Service environment
          schema:
            type: string
          example: prod
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_single_agent_configuration_response'
              examples:
                getSingleAgentConfigurationResponseExample1:
                  $ref: '#/components/examples/APM_UI_agent_configuration_intake_object_view_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_404_response'
              examples:
                notFoundResponse:
                  $ref: '#/components/examples/APM_UI_error_404_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/apm/sourcemaps:
    get:
      tags:
        - APM sourcemaps
      summary: Get source maps
      description: "Get an array of Fleet artifacts, including source map uploads. You must have `read` or `all` Kibana privileges for the APM and User Experience feature.\n"
      operationId: getSourceMaps
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - name: page
          in: query
          description: Page number
          schema:
            type: number
        - name: perPage
          in: query
          description: Number of records per page
          schema:
            type: number
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_source_maps_response'
              examples:
                getSourceMapsResponse1:
                  $ref: '#/components/examples/APM_UI_source_maps_get_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '500':
          description: Internal Server Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
        '501':
          description: Not Implemented response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_501_response'
              examples:
                notImplementedResponse:
                  $ref: '#/components/examples/APM_UI_error_501_response'
      x-codeSamples:
        - lang: Curl
          source: "curl -X GET \"http://localhost:5601/api/apm/sourcemaps\" \\\n-H 'Content-Type: application/json' \\\n-H 'kbn-xsrf: true' \\\n-H 'Authorization: ApiKey ${YOUR_API_KEY}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - APM sourcemaps
      summary: Upload a source map
      description: "Upload a source map for a specific service and version. You must have `all` Kibana privileges for the APM and User Experience feature.\nThe maximum payload size is `1mb`. If you attempt to upload a source map that exceeds the maximum payload size, you will get a 413 error. Before uploading source maps that exceed this default, change the maximum payload size allowed by Kibana with the `server.maxPayload` variable.\n"
      operationId: uploadSourceMap
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/APM_UI_upload_source_map_object'
            examples:
              uploadSourceMapRequest:
                $ref: '#/components/examples/APM_UI_source_maps_upload_request1'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_upload_source_maps_response'
              examples:
                uploadSourceMapResponse1:
                  $ref: '#/components/examples/APM_UI_source_maps_upload_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '500':
          description: Internal Server Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
        '501':
          description: Not Implemented response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_501_response'
              examples:
                notImplementedResponse:
                  $ref: '#/components/examples/APM_UI_error_501_response'
      x-codeSamples:
        - lang: Curl
          source: "curl -X POST \"http://localhost:5601/api/apm/sourcemaps\" \\\n-H 'Content-Type: multipart/form-data' \\\n-H 'kbn-xsrf: true' \\\n-H 'Authorization: ApiKey ${YOUR_API_KEY}' \\\n-F 'service_name=\"foo\"' \\\n-F 'service_version=\"1.0.0\"' \\\n-F 'bundle_filepath=\"/test/e2e/general-usecase/bundle.js\"' \\\n-F 'sourcemap=\"{\\\"version\\\":3,\\\"file\\\":\\\"static/js/main.chunk.js\\\",\\\"sources\\\":[\\\"fleet-source-map-client/src/index.css\\\",\\\"fleet-source-map-client/src/App.js\\\",\\\"webpack:///./src/index.css?bb0a\\\",\\\"fleet-source-map-client/src/index.js\\\",\\\"fleet-source-map-client/src/reportWebVitals.js\\\"],\\\"sourcesContent\\\":[\\\"content\\\"],\\\"mappings\\\":\\\"mapping\\\",\\\"sourceRoot\\\":\\\"\\\"}\"' \n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/apm/sourcemaps/{id}':
    delete:
      tags:
        - APM sourcemaps
      summary: Delete source map
      description: "Delete a previously uploaded source map. You must have `all` Kibana privileges for the APM and User Experience feature.\n"
      operationId: deleteSourceMap
      parameters:
        - $ref: '#/components/parameters/APM_UI_elastic_api_version'
        - $ref: '#/components/parameters/APM_UI_kbn_xsrf'
        - name: id
          in: path
          description: Source map identifier
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
                description: The response body is intentionally empty for this endpoint.
              examples:
                deleteSourceMapResponseExample1:
                  $ref: '#/components/examples/APM_UI_source_maps_delete_200_response1'
        '400':
          description: Bad Request response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_400_response'
              examples:
                badRequestResponse:
                  $ref: '#/components/examples/APM_UI_error_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_401_response'
              examples:
                unauthorizedResponse:
                  $ref: '#/components/examples/APM_UI_error_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_403_response'
              examples:
                forbiddenResponse:
                  $ref: '#/components/examples/APM_UI_error_403_response'
        '500':
          description: Internal Server Error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_500_response'
              examples:
                internalServerErrorResponse:
                  $ref: '#/components/examples/APM_UI_error_500_response'
        '501':
          description: Not Implemented response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/APM_UI_501_response'
              examples:
                notImplementedResponse:
                  $ref: '#/components/examples/APM_UI_error_501_response'
      x-codeSamples:
        - lang: Curl
          source: "curl -X DELETE \"http://localhost:5601/api/apm/sourcemaps/apm:foo-1.0.0-644fd5a9\" \\\n-H 'Content-Type: application/json' \\\n-H 'kbn-xsrf: true' \\\n-H 'Authorization: ApiKey ${YOUR_API_KEY}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/asset_criticality:
    delete:
      tags:
        - Security Entity Analytics API
      summary: Delete an asset criticality record
      description: "**Deprecated in 9.4.0.** Use the Entity Store APIs to unassign asset criticality for a specific entity.\n\nDelete the asset criticality record for a specific entity.\n"
      operationId: DeleteAssetCriticalityRecord
      parameters:
        - name: id_value
          in: query
          description: The ID value of the asset.
          required: true
          schema:
            type: string
          example: my_host
        - name: id_field
          in: query
          description: The field representing the ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
          example: host.name
        - name: refresh
          in: query
          description: If 'wait_for' the request will wait for the index refresh.
          schema:
            enum:
              - wait_for
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - deleted
                type: object
                properties:
                  deleted:
                    type: boolean
                    description: True if the record was deleted or false if the record did not exist.
                  record:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
        '400':
          description: Invalid request
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Entity Analytics API
      summary: Get an asset criticality record
      description: '**Deprecated in 9.4.0.** Get the asset criticality record for a specific entity.'
      operationId: GetAssetCriticalityRecord
      parameters:
        - name: id_value
          in: query
          description: The ID value of the asset.
          required: true
          schema:
            type: string
          example: my_host
        - name: id_field
          in: query
          description: The field representing the ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
          example: host.name
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
        '400':
          description: Invalid request
        '404':
          description: Criticality record not found
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Entity Analytics API
      summary: Upsert an asset criticality record
      description: "**Deprecated in 9.4.0.** Use the Entity Store APIs to assign asset criticality to an entity.\n\nCreate or update an asset criticality record for a specific entity.\n\nIf a record already exists for the specified entity, that record is overwritten with the specified value. If a record doesn't exist for the specified entity, a new record is created.\n"
      operationId: CreateAssetCriticalityRecord
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord'
                - type: object
                  properties:
                    refresh:
                      enum:
                        - wait_for
                      type: string
                      description: If 'wait_for' the request will wait for the index refresh.
              example:
                criticality_level: high_impact
                id_field: host.name
                id_value: my_host
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
        '400':
          description: Invalid request
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/asset_criticality/bulk:
    post:
      tags:
        - Security Entity Analytics API
      summary: Bulk upsert asset criticality records
      description: "**Deprecated in 9.4.0.** Use the Entity Store APIs to bulk assign asset criticality.\n\nBulk upsert up to 1000 asset criticality records.\n\nIf asset criticality records already exist for the specified entities, those records are overwritten with the specified values. If asset criticality records don't exist for the specified entities, new records are created.\n"
      operationId: BulkUpsertAssetCriticalityRecords
      requestBody:
        content:
          application/json:
            schema:
              required:
                - records
              type: object
              properties:
                records:
                  maxItems: 1000
                  minItems: 1
                  type: array
                  items:
                    allOf:
                      - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts'
                      - required:
                          - criticality_level
                        type: object
                        properties:
                          criticality_level:
                            $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload'
              example:
                records:
                  - criticality_level: low_impact
                    id_field: host.name
                    id_value: host-1
                  - criticality_level: medium_impact
                    id_field: host.name
                    id_value: host-2
      responses:
        '200':
          description: Bulk upload successful
          content:
            application/json:
              schema:
                required:
                  - errors
                  - stats
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem'
                  stats:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats'
                example:
                  errors:
                    - index: 0
                      message: Invalid ID field
                  stats:
                    failed: 1
                    successful: 1
                    total: 2
        '413':
          description: File too large
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/asset_criticality/list:
    get:
      tags:
        - Security Entity Analytics API
      summary: List asset criticality records
      description: '**Deprecated in 9.4.0.** List asset criticality records, paging, sorting and filtering as needed.'
      operationId: FindAssetCriticalityRecords
      parameters:
        - name: sort_field
          in: query
          description: The field to sort by.
          schema:
            enum:
              - id_value
              - id_field
              - criticality_level
              - '@timestamp'
            type: string
        - name: sort_direction
          in: query
          description: The order to sort by.
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: page
          in: query
          description: The page number to return.
          schema:
            minimum: 1
            type: integer
        - name: per_page
          in: query
          description: The number of records to return per page.
          schema:
            maximum: 1000
            minimum: 1
            type: integer
        - name: kuery
          in: query
          description: The kuery to filter by.
          schema:
            type: string
      responses:
        '200':
          description: Successfully retrieved asset criticality records
          content:
            application/json:
              schema:
                required:
                  - records
                  - page
                  - per_page
                  - total
                type: object
                properties:
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    maximum: 1000
                    minimum: 1
                    type: integer
                  records:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecord'
                  total:
                    minimum: 0
                    type: integer
                example:
                  page: 1
                  per_page: 10
                  records:
                    - '@timestamp': '2024-08-02T14:40:35.705Z'
                      asset:
                        criticality: medium_impact
                      criticality_level: medium_impact
                      host:
                        asset:
                          criticality: medium_impact
                        name: my_other_host
                      id_field: host.name
                      id_value: my_other_host
                    - '@timestamp': '2024-08-02T11:15:34.290Z'
                      asset:
                        criticality: high_impact
                      criticality_level: high_impact
                      host:
                        asset:
                          criticality: high_impact
                        name: my_host
                      id_field: host.name
                      id_value: my_host
                  total: 2
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/_bulk:
    post:
      tags:
        - Security Attack discovery API
      summary: Bulk update Attack discoveries
      description: 'Performs bulk updates on multiple Attack discoveries, including workflow status changes and visibility settings. This endpoint allows efficient batch processing of alert modifications without requiring individual API calls for each alert.'
      operationId: PostAttackDiscoveryBulk
      requestBody:
        description: Bulk update parameters for Attack discoveries
        content:
          application/json:
            schema:
              required:
                - update
              type: object
              properties:
                update:
                  required:
                    - ids
                  type: object
                  properties:
                    enable_field_rendering:
                      type: boolean
                      description: 'Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.'
                      default: false
                      example: false
                    ids:
                      type: array
                      items:
                        type: string
                      description: Array of Attack Discovery IDs to update
                      example:
                        - c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        - 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
                    kibana_alert_workflow_status:
                      enum:
                        - open
                        - acknowledged
                        - closed
                      type: string
                      description: 'When provided, update the kibana.alert.workflow_status of the attack discovery alerts'
                      example: acknowledged
                    visibility:
                      enum:
                        - not_shared
                        - shared
                      type: string
                      description: 'When provided, update the visibility of the alert, as determined by the kibana.alert.attack_discovery.users field'
                      example: shared
                    with_replacements:
                      type: boolean
                      description: 'When true, returns the updated Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. This substitutes anonymized values with human-readable equivalents. Defaults to `true`.'
                      default: true
                      example: true
                  description: Configuration object containing all parameters for the bulk update operation
            examples:
              PostAttackDiscoveryBulkRequestBodyExample:
                summary: Acknowledge two Attack discoveries in bulk.
                value:
                  update:
                    enable_field_rendering: false
                    ids:
                      - c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                      - 5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7
                    kibana_alert_workflow_status: acknowledged
                    with_replacements: true
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    description: Array of updated Attack Discovery alert objects. Each item includes the applied modifications from the bulk update request.
              examples:
                PostAttackDiscoveryBulkResponse200Example:
                  summary: A successful bulk update response containing the modified Attack discoveries.
                  value:
                    data:
                      - alert_ids:
                          - alert-abc-1
                        alert_workflow_status: acknowledged
                        connector_id: gen-ai-connector
                        connector_name: OpenAI GPT-4
                        details_markdown: '- **Host** `workstation-01` showed credential access patterns consistent with mimikatz.'
                        generation_uuid: 550e8400-e29b-41d4-a716-446655440000
                        id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        summary_markdown: A user account was compromised using mimikatz to dump credentials.
                        timestamp: '2024-01-15T10:00:00.000Z'
                        title: Credential theft via mimikatz
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                required:
                  - status_code
                  - error
                  - message
                type: object
                properties:
                  error:
                    type: string
                    description: Error type
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message describing what went wrong with the bulk update request
                    example: Invalid request parameters.
                  status_code:
                    type: number
                    description: HTTP status code
                    example: 400
              examples:
                PostAttackDiscoveryBulkResponse400Example:
                  summary: Bad Request error returned when the bulk update payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_bulk' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data-raw '{\n   \"update\": {\n     \"ids\": [\n       \"c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f\",\n       \"5aa8f2900c0b03854b3b1a52a19558c5ea9893865c78235d4ad3dcc46196f4c7\"\n     ],\n     \"kibana_alert_workflow_status\": \"acknowledged\"\n   }\n }'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/_find:
    get:
      tags:
        - Security Attack discovery API
      summary: Find Attack discoveries that match the search criteria
      description: 'Find Attack discoveries that match the search criteria. Supports free text search, filtering, pagination, and sorting.'
      operationId: AttackDiscoveryFind
      parameters:
        - name: alert_ids
          in: query
          description: Filter results to Attack discoveries that include any of the provided alert IDs
          schema:
            type: array
            items:
              type: string
        - name: connector_names
          in: query
          description: 'Filter results to Attack discoveries created by any of the provided human readable connector names. Note that values must match the human readable `connector_name` property of an Attack discovery, e.g. "GPT-5 Chat", which are distinct from `connector_id` values used to generate Attack discoveries.'
          schema:
            type: array
            items:
              type: string
        - name: enable_field_rendering
          in: query
          description: 'Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.'
          schema:
            type: boolean
            default: false
          example: false
        - name: end
          in: query
          description: 'End of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").'
          schema:
            type: string
          example: now
        - name: ids
          in: query
          description: Filter results to the Attack discoveries with the specified IDs
          schema:
            type: array
            items:
              type: string
        - name: include_unique_alert_ids
          in: query
          description: 'If `true`, the response will include `unique_alert_ids` and `unique_alert_ids_count` aggregated across the matched Attack discoveries'
          schema:
            type: boolean
          example: false
        - name: page
          in: query
          description: Page number to return (used for pagination). Defaults to 1.
          schema:
            minimum: 1
            type: integer
            default: 1
          example: 1
        - name: per_page
          in: query
          description: Number of Attack discoveries to return per page (used for pagination). Defaults to 10.
          schema:
            minimum: 1
            type: integer
            default: 10
          example: 10
        - name: search
          in: query
          description: 'Free-text search query applied to relevant text fields of Attack discoveries (title, description, tags, etc.)'
          schema:
            type: string
          example: ''
        - name: shared
          in: query
          description: 'Whether to filter by shared visibility. If omitted, both shared and privately visible Attack discoveries are returned. Use `true` to return only shared discoveries, `false` to return only those visible to the current user. Mutually exclusive with `include_all_authors`.'
          schema:
            type: boolean
        - name: include_all_authors
          in: query
          description: 'If `true`, the response will include all attack discoveries matching other criteria regardless of who created them. Mutually exclusive with `shared`.'
          schema:
            type: boolean
        - name: scheduled
          in: query
          description: 'Whether to filter by scheduled or ad-hoc attack discoveries. If omitted, both types of attack discoveries are returned. Use `true` to return only scheduled discoveries or `false` to return only ad-hoc discoveries.'
          schema:
            type: boolean
        - name: sort_field
          in: query
          description: Field used to sort results. See `AttackDiscoveryFindSortField` for allowed values.
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryFindSortField'
          example: '@timestamp'
        - name: sort_order
          in: query
          description: Sort order direction `asc` for ascending or `desc` for descending. Defaults to `desc`.
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_SortOrder'
          example: desc
        - name: start
          in: query
          description: Start of the time range for the search. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
          schema:
            type: string
          example: now-24h
        - name: status
          in: query
          description: Filter by alert workflow status. Provide one or more of the allowed workflow states.
          schema:
            type: array
            items:
              enum:
                - acknowledged
                - closed
                - open
              type: string
          example:
            - open
            - acknowledged
        - name: with_replacements
          in: query
          description: 'When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.'
          schema:
            type: boolean
            default: true
          example: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - connector_names
                  - data
                  - page
                  - per_page
                  - total
                  - unique_alert_ids_count
                type: object
                properties:
                  connector_names:
                    type: array
                    items:
                      type: string
                    description: List of human readable connector names that are present in the matched Attack discoveries. Useful for building client filters or summaries.
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    description: Array of matched Attack discovery objects. Each item follows the `AttackDiscoveryApiAlert` schema.
                  page:
                    type: integer
                    description: Current page number of the paginated result set.
                  per_page:
                    type: integer
                    description: Number of items requested per page.
                  total:
                    type: integer
                    description: Total number of Attack discoveries matching the query (across all pages).
                  unique_alert_ids:
                    type: array
                    items:
                      type: string
                    description: List of unique alert IDs aggregated from the matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
                  unique_alert_ids_count:
                    type: integer
                    description: Number of unique alert IDs across all matched Attack discoveries. Only present if `include_unique_alert_ids=true` in the request.
              examples:
                AttackDiscoveryFindResponse200Example:
                  summary: Paginated list of Attack discoveries matching the search criteria.
                  value:
                    connector_names:
                      - GPT-5 Chat
                    data:
                      - connector_name: GPT-5 Chat
                        id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        title: Suspicious process execution on host-01
                    page: 1
                    per_page: 10
                    total: 1
                    unique_alert_ids_count: 0
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error type
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message
                    example: Invalid request payload.
                  status_code:
                    type: number
                    description: HTTP status code
                    example: 400
              examples:
                AttackDiscoveryFindResponse400Example:
                  summary: Bad Request error returned when find query parameters are invalid.
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/_find?end=now&include_unique_alert_ids=false&page=1&per_page=10&search=&sort_field=%40timestamp&sort_order=desc&start=now-24h&status=open&status=acknowledged' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/_generate:
    post:
      tags:
        - Security Attack discovery API
      summary: Generate attack discoveries from alerts
      description: Initiates the generation of attack discoveries by analyzing security alerts using AI. Returns an execution UUID that can be used to track the generation progress and retrieve results. Results may also be retrieved via the find endpoint.
      operationId: PostAttackDiscoveryGenerate
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenerationConfig'
            examples:
              PostAttackDiscoveryGenerateRequestBodyExample:
                summary: Generate Attack discoveries from alerts in the last 24 hours.
                value:
                  alertsIndexPattern: .alerts-security.alerts-default
                  anonymizationFields:
                    - allowed: true
                      anonymized: true
                      field: host.name
                    - allowed: true
                      anonymized: true
                      field: user.name
                    - allowed: true
                      anonymized: false
                      field: process.name
                  apiConfig:
                    actionTypeId: .gen-ai
                    connectorId: 12345678-1234-1234-1234-123456789012
                  connectorName: GPT-5 Chat
                  end: now
                  replacements: { }
                  size: 100
                  start: now-24h
                  subAction: invokeAI
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - execution_uuid
                type: object
                properties:
                  execution_uuid:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
              examples:
                PostAttackDiscoveryGenerateResponse200Example:
                  summary: Generation started; use the returned execution UUID to track progress.
                  value:
                    execution_uuid: edd26039-0990-4d9f-9829-2a1fcacb77b5
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                required:
                  - status_code
                  - error
                  - message
                type: object
                properties:
                  error:
                    type: string
                    description: Error type
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message describing what went wrong
                    example: Invalid request parameters.
                  status_code:
                    type: number
                    description: HTTP status code
                    example: 400
              examples:
                PostAttackDiscoveryGenerateResponse400Example:
                  summary: Bad Request error returned when the generate payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/_generate' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n    \"alertsIndexPattern\": \".alerts-security.alerts-default\",\n    \"anonymizationFields\": [\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"@timestamp\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"aKiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.feature\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"saiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.data\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"sqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.entropy\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"s6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.extension\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"tKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.metrics\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"taiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.operation\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"tqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.path\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"t6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.files.score\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"uKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"Ransomware.version\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"uaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"_id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"Z6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"agent.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"aaiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"cloud.availability_zone\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"aqiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"cloud.provider\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"a6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"cloud.region\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"bKiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"destination.ip\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"baiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"dns.question.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"bqiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"dns.question.type\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"b6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.category\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"cKiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.dataset\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"caiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.module\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"cqiJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"event.outcome\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"c6iJW5gB4U27o8XO8oLf\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.Ext.original.path\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"dKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.hash.sha256\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"daiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"dqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"file.path\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"d6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"group.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"eKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"group.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"eaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.asset.criticality\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"eqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.name\",\n        \"allowed\": true,\n        \"anonymized\": true,\n        \"namespace\": \"default\",\n        \"id\": \"e6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.os.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"fKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.os.version\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"faiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.risk.calculated_level\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"fqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"host.risk.calculated_score_norm\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"f6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.original_time\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"gKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.risk_score\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"gaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.description\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"gqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"g6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.references\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"hKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.framework\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"haiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.tactic.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"hqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.tactic.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"h6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.tactic.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"iKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"iaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"iqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"i6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.subtechnique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"jKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.subtechnique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"jaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.rule.threat.technique.subtechnique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"jqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.severity\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"j6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"kibana.alert.workflow_status\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"kKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"message\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"kaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"network.protocol\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"kqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.bytes_compressed_present\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"nKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.malware_signature.all_names\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"naiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.malware_signature.primary.matches\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"nqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.memory_region.malware_signature.primary.signature.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"n6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.Ext.token.integrity_level_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"oKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.args\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"k6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.exists\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"lKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.signing_id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"laiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.status\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"lqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.subject_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"l6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.code_signature.trusted\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"mKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.command_line\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"maiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.executable\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"mqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.exit_code\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"m6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.hash.md5\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"oaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.hash.sha1\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"oqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.hash.sha256\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"o6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"pKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.args\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"paiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.args_count\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"pqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.exists\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"p6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.status\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"qKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.subject_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"qaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.code_signature.trusted\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"qqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.command_line\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"q6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.executable\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"rKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.parent.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"raiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.pe.original_file_name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"rqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.pid\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"r6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"process.working_directory\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"sKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"rule.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"uqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"rule.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"u6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"source.ip\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"vKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.framework\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"vaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.tactic.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"vqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.tactic.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"v6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.tactic.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"wKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"waiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"wqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"w6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.subtechnique.id\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"xKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.subtechnique.name\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"xaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"threat.technique.subtechnique.reference\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"xqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.asset.criticality\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"x6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.domain\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"yKiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.name\",\n        \"allowed\": true,\n        \"anonymized\": true,\n        \"namespace\": \"default\",\n        \"id\": \"yaiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.risk.calculated_level\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"yqiJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.risk.calculated_score_norm\",\n        \"allowed\": true,\n        \"anonymized\": false,\n        \"namespace\": \"default\",\n        \"id\": \"y6iJW5gB4U27o8XO8oLg\"\n      },\n      {\n        \"timestamp\": \"2025-07-30T13:33:44.029Z\",\n        \"createdAt\": \"2025-07-30T13:33:44.029Z\",\n        \"field\": \"user.target.name\",\n        \"allowed\": true,\n        \"anonymized\": true,\n        \"namespace\": \"default\",\n        \"id\": \"zKiJW5gB4U27o8XO8oLg\"\n      }\n    ],\n    \"replacements\": {},\n    \"size\": 100,\n    \"subAction\": \"invokeAI\",\n    \"apiConfig\": {\n      \"connectorId\": \"12345678-1234-1234-1234-123456789012\",\n      \"actionTypeId\": \".gen-ai\"\n    },\n    \"connectorName\": \"GPT-5 Chat\",\n    \"end\": \"now\",\n    \"start\": \"now-24h\"\n  }'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/generations:
    get:
      tags:
        - Security Attack discovery API
      summary: Get the latest Attack Discovery generations metadata for the current user
      description: Get the latest Attack Discovery generations metadata (that are not dismissed) for the current user. This endpoint retrieves generation metadata including execution status and statistics for Attack Discovery generations.
      operationId: GetAttackDiscoveryGenerations
      parameters:
        - name: end
          in: query
          description: 'End of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now", "now-24h").'
          schema:
            type: string
          example: now
        - name: size
          in: query
          description: The maximum number of generations to retrieve
          schema:
            minimum: 1
            type: number
            default: 50
          example: 50
        - name: scheduled
          in: query
          description: 'Whether to filter by scheduled or ad-hoc attack discovery generations. If omitted, both types are returned. Use `true` to return only scheduled generations or `false` to return only ad-hoc (interactive or action-triggered) generations.'
          schema:
            type: boolean
        - name: start
          in: query
          description: Start of the time range for filtering generations. Accepts absolute timestamps (ISO 8601) or relative date math (e.g. "now-7d").
          schema:
            type: string
          example: now-24h
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - generations
                type: object
                properties:
                  generations:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGeneration'
                    description: List of Attack Discovery generations
              examples:
                GetAttackDiscoveryGenerationsResponse200Example:
                  summary: Latest Attack Discovery generation metadata for the current user.
                  value:
                    generations:
                      - alerts_context_count: 75
                        connector_id: chatGpt5_0ChatAzure
                        discoveries: 3
                        end: '2025-09-29T06:42:44.810Z'
                        execution_uuid: 46b218d5-535d-4329-be56-d0f6af6986b7
                        loading_message: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                        start: '2025-09-29T06:42:08.962Z'
                        status: succeeded
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error type
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message
                    example: Invalid size parameter. Must be a positive number.
                  status_code:
                    type: number
                    description: HTTP status code
                    example: 400
              examples:
                GetAttackDiscoveryGenerationsResponse400Example:
                  summary: Bad Request error returned when the size parameter is invalid.
                  value:
                    error: Bad Request
                    message: Invalid size parameter. Must be a positive number.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/generations?size=50&start=now-24h&end=now' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/attack_discovery/generations/{execution_uuid}':
    get:
      tags:
        - Security Attack discovery API
      summary: 'Get a single Attack Discovery generation, including its discoveries and (optional) generation metadata'
      description: 'Returns a specific Attack Discovery generation, including all generated Attack discoveries and associated metadata, including execution status and statistics.'
      operationId: GetAttackDiscoveryGeneration
      parameters:
        - name: execution_uuid
          in: path
          description: The unique identifier for the Attack Discovery generation execution. This UUID is returned at the start of an Attack Discovery generation.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 2e13f386-46cf-4d65-9e2b-68609e132ba5
        - name: enable_field_rendering
          in: query
          description: 'Enables a markdown syntax used to render pivot fields, for example `{{ user.name james }}`. When disabled, the same example would be rendered as `james`. This is primarily used for Attack Discovery views within Kibana. Defaults to `false`.'
          schema:
            type: boolean
            default: false
          example: false
        - name: with_replacements
          in: query
          description: 'When true, return the created Attack discoveries with text replacements applied to the detailsMarkdown, entitySummaryMarkdown, summaryMarkdown, and title fields. Defaults to `true`.'
          schema:
            type: boolean
            default: true
          example: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiAlert'
                    description: Array of Attack discoveries generated during this execution.
                  generation:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGeneration'
              examples:
                GetAttackDiscoveryGenerationResponse200Example:
                  summary: Single Attack Discovery generation with its discoveries and metadata.
                  value:
                    data:
                      - id: c0c8a8bbb4a6561856a974ee9e461f0c82e673a1f0d83f86c5a8d80fc8de4c4f
                        title: Suspicious process execution on host-01
                    generation:
                      alerts_context_count: 50
                      discoveries: 1
                      end: '2025-09-29T06:42:44.810Z'
                      execution_uuid: 2e13f386-46cf-4d65-9e2b-68609e132ba5
                      start: '2025-09-29T06:42:08.962Z'
                      status: succeeded
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                required:
                  - status_code
                  - error
                  - message
                type: object
                properties:
                  error:
                    type: string
                    description: Error type
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message describing what went wrong with the request
                    example: Invalid request parameters.
                  status_code:
                    type: number
                    description: HTTP status code
                    example: 400
              examples:
                GetAttackDiscoveryGenerationResponse400Example:
                  summary: Bad Request error returned when the get-generation request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/generations/2e13f386-46cf-4d65-9e2b-68609e132ba5' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/attack_discovery/generations/{execution_uuid}/_dismiss':
    post:
      tags:
        - Security Attack discovery API
      summary: Dismiss an Attack Discovery generation
      description: 'Dismisses an Attack Discovery generation for the current user, indicating that its status should not be reported in the UI. This sets the generation''s status to "dismissed" and affects how the generation appears in subsequent queries.'
      operationId: PostAttackDiscoveryGenerationsDismiss
      parameters:
        - name: execution_uuid
          in: path
          description: The unique identifier for the Attack Discovery generation execution. This UUID is returned when an Attack Discovery generation is created and can be found in generation responses.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 46b218d5-535d-4329-be56-d0f6af6986b7
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - connector_id
                  - discoveries
                  - execution_uuid
                  - start
                  - status
                type: object
                properties:
                  alerts_context_count:
                    type: number
                    description: The number of alerts that were sent as context to the LLM for this generation.
                    example: 75
                  connector_id:
                    type: string
                    description: The unique identifier of the connector used to generate the attack discoveries.
                    example: chatGpt5_0ChatAzure
                  connector_stats:
                    type: object
                    properties:
                      average_successful_duration_nanoseconds:
                        type: number
                        description: The average duration in nanoseconds for successful generations using this connector by the current user.
                        example: 47958500000
                      successful_generations:
                        type: number
                        description: The total number of Attack discoveries successfully created for this generation
                        example: 2
                    description: 'Statistical information about the connector''s performance for this user, providing insights into usage patterns and success rates.'
                  discoveries:
                    type: number
                    description: The number of attack discoveries that were generated during this execution.
                    example: 3
                  end:
                    type: string
                    description: 'The timestamp when the generation process completed, in ISO 8601 format. This field may be absent for generations that haven''t finished.'
                    example: '2025-09-29T06:42:44.810Z'
                  execution_uuid:
                    type: string
                    description: The unique identifier for this attack discovery generation execution. This UUID can be used to reference this specific generation in other API calls.
                    example: 46b218d5-535d-4329-be56-d0f6af6986b7
                  loading_message:
                    type: string
                    description: A human-readable message describing the current state or progress of the generation process. Provides context about what the AI is analyzing.
                    example: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                  reason:
                    type: string
                    description: Additional context or reasoning provided when a generation fails or encounters issues. This field helps diagnose problems with the generation process.
                    example: Connection timeout to AI service
                  start:
                    type: string
                    description: 'The timestamp when the generation process began, in ISO 8601 format. This marks the beginning of the AI analysis.'
                    example: '2025-09-29T06:42:08.962Z'
                  status:
                    enum:
                      - canceled
                      - dismissed
                      - failed
                      - started
                      - succeeded
                    type: string
                    description: 'The current status of the attack discovery generation. After dismissing, this will be set to "dismissed".'
                    example: dismissed
              examples:
                PostAttackDiscoveryGenerationsDismissResponse200Example:
                  summary: Successfully dismissed an Attack Discovery generation.
                  value:
                    alerts_context_count: 75
                    connector_id: chatGpt5_0ChatAzure
                    discoveries: 3
                    end: '2025-09-29T06:42:44.810Z'
                    execution_uuid: 46b218d5-535d-4329-be56-d0f6af6986b7
                    loading_message: AI is analyzing up to 100 alerts in the last 24 hours to generate discoveries.
                    start: '2025-09-29T06:42:08.962Z'
                    status: dismissed
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                required:
                  - status_code
                  - error
                  - message
                type: object
                properties:
                  error:
                    type: string
                    description: Error type or category
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message describing what went wrong with the request.
                    example: Invalid request parameters.
                  status_code:
                    type: number
                    description: HTTP status code indicating the type of client error
                    example: 400
              examples:
                PostAttackDiscoveryGenerationsDismissResponse400Example:
                  summary: Bad Request error returned when the dismiss request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/generations/46b218d5-535d-4329-be56-d0f6af6986b7/_dismiss' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules:
    post:
      tags:
        - Security Attack discovery API
      summary: Create Attack Discovery schedule
      description: 'Creates a new Attack Discovery schedule that analyzes security alerts at specified intervals. The schedule defines when and how Attack Discovery analysis should run, including which alerts to analyze, which AI connector to use, and what actions to take when discoveries are found.'
      operationId: CreateAttackDiscoverySchedules
      requestBody:
        description: 'Attack Discovery schedule configuration including name, parameters, schedule interval, and actions'
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps'
            examples:
              CreateAttackDiscoverySchedulesRequestBodyExample:
                summary: Create a daily Attack Discovery schedule that runs every 24 hours.
                value:
                  actions: [ ]
                  enabled: true
                  name: Daily Security Analysis
                  params:
                    alerts_index_pattern: .alerts-security.alerts-default
                    api_config:
                      actionTypeId: bedrock
                      connectorId: my-bedrock-connector
                      name: Claude 3.5 Sonnet
                    end: now
                    size: 100
                    start: now-24h
                  schedule:
                    interval: 24h
        required: true
      responses:
        '200':
          description: The Attack Discovery schedule was successfully created.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
              examples:
                CreateAttackDiscoverySchedulesResponse200Example:
                  summary: A newly created Attack Discovery schedule.
                  value:
                    actions: [ ]
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    name: Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 100
                      start: now-24h
                    schedule:
                      interval: 24h
                    updated_at: '2023-10-31T10:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                CreateAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the create schedule payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Create an Attack Discovery schedule
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n   \"name\": \"Daily Security Analysis\",\n   \"enabled\": true,\n   \"params\": {\n     \"alerts_index_pattern\": \".alerts-security.alerts-default\",\n     \"api_config\": {\n       \"actionTypeId\": \"bedrock\",\n       \"connectorId\": \"my-bedrock-connector\",\n       \"name\": \"Claude 3.5 Sonnet\"\n     },\n     \"size\": 100,\n     \"start\": \"now-24h\",\n     \"end\": \"now\"\n   },\n   \"schedule\": {\n     \"interval\": \"24h\"\n   },\n   \"actions\": [\n      {\n         \"action_type_id\": \".cases\",\n         \"id\": \"system-connector-.cases\",\n         \"params\": {\n           \"subAction\": \"run\",\n           \"subActionParams\": {\n             \"timeWindow\": \"7d\",\n             \"reopenClosedCases\": false,\n             \"groupingBy\": [],\n             \"templateId\": null\n           }\n         },\n         \"uuid\": \"12345678-1234-1234-1234-123456789012\"\n       }\n   ]\n }'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_bulk_delete:
    post:
      tags:
        - Security Attack discovery API
      summary: Bulk delete Attack Discovery schedules
      description: Deletes multiple Attack Discovery schedules by ID.
      operationId: BulkDeleteAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody'
            examples:
              BulkDeleteAttackDiscoverySchedulesRequestBodyExample:
                summary: Delete two Attack Discovery schedules.
                value:
                  ids:
                    - 12345678-1234-1234-1234-123456789012
                    - 98765432-1234-1234-1234-123456789012
        required: true
      responses:
        '200':
          description: Successfully processed the bulk delete request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse'
              examples:
                BulkDeleteAttackDiscoverySchedulesResponse200Example:
                  summary: Bulk delete response for two successfully deleted schedules.
                  value:
                    errors: [ ]
                    ids:
                      - 12345678-1234-1234-1234-123456789012
                      - 98765432-1234-1234-1234-123456789012
                    total: 2
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                BulkDeleteAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the bulk delete payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_bulk_disable:
    post:
      tags:
        - Security Attack discovery API
      summary: Bulk disable Attack Discovery schedules
      description: Disables multiple Attack Discovery schedules by ID.
      operationId: BulkDisableAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody'
            examples:
              BulkDisableAttackDiscoverySchedulesRequestBodyExample:
                summary: Disable two Attack Discovery schedules.
                value:
                  ids:
                    - 12345678-1234-1234-1234-123456789012
                    - 98765432-1234-1234-1234-123456789012
        required: true
      responses:
        '200':
          description: Successfully processed the bulk disable request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse'
              examples:
                BulkDisableAttackDiscoverySchedulesResponse200Example:
                  summary: Bulk disable response for two successfully disabled schedules.
                  value:
                    errors: [ ]
                    ids:
                      - 12345678-1234-1234-1234-123456789012
                      - 98765432-1234-1234-1234-123456789012
                    total: 2
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                BulkDisableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the bulk disable payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_bulk_enable:
    post:
      tags:
        - Security Attack discovery API
      summary: Bulk enable Attack Discovery schedules
      description: Enables multiple Attack Discovery schedules by ID.
      operationId: BulkEnableAttackDiscoverySchedules
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody'
            examples:
              BulkEnableAttackDiscoverySchedulesRequestBodyExample:
                summary: Enable two Attack Discovery schedules.
                value:
                  ids:
                    - 12345678-1234-1234-1234-123456789012
                    - 98765432-1234-1234-1234-123456789012
        required: true
      responses:
        '200':
          description: Successfully processed the bulk enable request.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse'
              examples:
                BulkEnableAttackDiscoverySchedulesResponse200Example:
                  summary: Bulk enable response for two successfully enabled schedules.
                  value:
                    errors: [ ]
                    ids:
                      - 12345678-1234-1234-1234-123456789012
                      - 98765432-1234-1234-1234-123456789012
                    total: 2
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                BulkEnableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the bulk enable payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/attack_discovery/schedules/_find:
    get:
      tags:
        - Security Attack discovery API
      summary: Find Attack Discovery schedules that match the search criteria
      description: Find Attack Discovery schedules that match the search criteria. Supports pagination and sorting by various fields.
      operationId: FindAttackDiscoverySchedules
      parameters:
        - name: page
          in: query
          description: Page number to return (used for pagination). Defaults to 1.
          schema:
            type: number
          example: 1
        - name: per_page
          in: query
          description: Number of Attack Discovery schedules to return per page (used for pagination). Defaults to 10.
          schema:
            type: number
          example: 10
        - name: sort_field
          in: query
          description: 'Field used to sort results. Common fields include ''name'', ''created_at'', ''updated_at'', and ''enabled''.'
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: name
        - name: sort_direction
          in: query
          description: Sort order direction. Use 'asc' for ascending or 'desc' for descending. Defaults to 'asc'.
          schema:
            enum:
              - asc
              - desc
            type: string
          example: asc
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - page
                  - per_page
                  - total
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
                    description: Array of matched Attack Discovery schedule objects.
                  page:
                    type: number
                    description: Current page number of the paginated result set.
                  per_page:
                    type: number
                    description: Number of items requested per page.
                  total:
                    type: number
                    description: Total number of Attack Discovery schedules matching the query (across all pages).
              examples:
                FindAttackDiscoverySchedulesResponse200Example:
                  summary: Paginated list of Attack Discovery schedules matching the search criteria.
                  value:
                    data:
                      - actions: [ ]
                        created_at: '2023-10-31T10:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        id: 12345678-1234-1234-1234-123456789012
                        name: Daily Security Analysis
                        params:
                          alerts_index_pattern: .alerts-security.alerts-default
                          api_config:
                            actionTypeId: bedrock
                            connectorId: my-bedrock-connector
                            name: Claude 3.5 Sonnet
                          end: now
                          size: 100
                          start: now-24h
                        schedule:
                          interval: 24h
                        updated_at: '2023-10-31T10:00:00.000Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 1
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error type
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message
                    example: Invalid request payload.
                  status_code:
                    type: number
                    description: HTTP status code
                    example: 400
              examples:
                FindAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when find-schedules query parameters are invalid.
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    status_code: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/schedules/_find' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/attack_discovery/schedules/{id}':
    delete:
      tags:
        - Security Attack discovery API
      summary: Delete Attack Discovery schedule
      description: Permanently deletes an Attack Discovery schedule and all associated configuration.
      operationId: DeleteAttackDiscoverySchedules
      parameters:
        - name: id
          in: path
          description: The unique identifier (UUID) of the Attack Discovery schedule to delete. This ID is returned when creating a schedule and can be found in schedule listings.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 12345678-1234-1234-1234-123456789012
      responses:
        '200':
          description: 'Successfully deleted Attack Discovery schedule, returning the ID of the deleted schedule for confirmation'
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
              examples:
                DeleteAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after deleting an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                DeleteAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the delete schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Delete an Attack Discovery schedule
          lang: curl
          source: "curl \\\n --request DELETE 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Attack discovery API
      summary: Get Attack Discovery schedule by ID
      description: 'Retrieves a specific Attack Discovery schedule by its unique identifier. Returns complete schedule configuration including parameters, interval settings, associated actions, and execution history.'
      operationId: GetAttackDiscoverySchedules
      parameters:
        - name: id
          in: path
          description: The unique identifier (UUID) of the Attack Discovery schedule to retrieve. This ID is returned when creating a schedule and can be found in schedule listings.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 12345678-1234-1234-1234-123456789012
      responses:
        '200':
          description: Successfully retrieved Attack Discovery schedule with complete configuration and metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
              examples:
                GetAttackDiscoverySchedulesResponse200Example:
                  summary: 'An Attack Discovery schedule retrieved by ID, including last execution metadata.'
                  value:
                    actions: [ ]
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    last_execution:
                      date: '2023-10-31T10:00:00.000Z'
                      last_duration: 45.2
                      status: ok
                    name: Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 100
                      start: now-24h
                    schedule:
                      interval: 24h
                    updated_at: '2023-10-31T10:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                GetAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the get-schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Get an Attack Discovery schedule by ID
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Attack discovery API
      summary: Update Attack Discovery schedule
      description: 'Updates an existing Attack Discovery schedule with new configuration. All schedule properties can be modified including name, parameters, interval, and actions. The update operation replaces the entire schedule configuration with the provided values.'
      operationId: UpdateAttackDiscoverySchedules
      parameters:
        - name: id
          in: path
          description: The unique identifier (UUID) of the Attack Discovery schedule to update. This ID is returned when creating a schedule and can be found in schedule listings.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 12345678-1234-1234-1234-123456789012
      requestBody:
        description: Updated Attack Discovery schedule configuration. All fields are required as this replaces the entire schedule configuration.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps'
            examples:
              UpdateAttackDiscoverySchedulesRequestBodyExample:
                summary: Update an Attack Discovery schedule to run every 12 hours over a 48-hour window.
                value:
                  actions: [ ]
                  name: Updated Daily Security Analysis
                  params:
                    alerts_index_pattern: .alerts-security.alerts-default
                    api_config:
                      actionTypeId: bedrock
                      connectorId: my-bedrock-connector
                      name: Claude 3.5 Sonnet
                    end: now
                    size: 200
                    start: now-48h
                  schedule:
                    interval: 12h
        required: true
      responses:
        '200':
          description: Successfully updated Attack Discovery schedule with the new configuration and metadata
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiSchedule'
              examples:
                UpdateAttackDiscoverySchedulesResponse200Example:
                  summary: An Attack Discovery schedule after being updated.
                  value:
                    actions: [ ]
                    created_at: '2023-10-31T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: 12345678-1234-1234-1234-123456789012
                    name: Updated Daily Security Analysis
                    params:
                      alerts_index_pattern: .alerts-security.alerts-default
                      api_config:
                        actionTypeId: bedrock
                        connectorId: my-bedrock-connector
                        name: Claude 3.5 Sonnet
                      end: now
                      size: 200
                      start: now-48h
                    schedule:
                      interval: 12h
                    updated_at: '2023-10-31T12:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                UpdateAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the update schedule payload is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Update an Attack Discovery schedule
          lang: curl
          source: "curl \\\n --request PUT 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\n   \"name\": \"Updated Daily Security Analysis\",\n   \"params\": {\n     \"alerts_index_pattern\": \".alerts-security.alerts-default\",\n     \"api_config\": {\n       \"actionTypeId\": \"bedrock\",\n       \"connectorId\": \"my-bedrock-connector\",\n       \"name\": \"Claude 3.5 Sonnet\"\n     },\n     \"size\": 200,\n     \"start\": \"now-48h\",\n     \"end\": \"now\"\n   },\n   \"schedule\": {\n     \"interval\": \"12h\"\n   },\n   \"actions\": []\n }'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/attack_discovery/schedules/{id}/_disable':
    post:
      tags:
        - Security Attack discovery API
      summary: Disable Attack Discovery schedule
      description: 'Disables an Attack Discovery schedule, preventing it from running according to its configured interval. The schedule configuration is preserved and can be re-enabled later. Any currently running executions will complete, but no new executions will be started.'
      operationId: DisableAttackDiscoverySchedules
      parameters:
        - name: id
          in: path
          description: The unique identifier (UUID) of the Attack Discovery schedule to disable. This ID is returned when creating a schedule and can be found in schedule listings.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 12345678-1234-1234-1234-123456789012
      responses:
        '200':
          description: 'Successfully disabled Attack Discovery schedule, returning the schedule ID for confirmation'
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
              examples:
                DisableAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after disabling an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                DisableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the disable schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Disable an Attack Discovery schedule
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_disable' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/attack_discovery/schedules/{id}/_enable':
    post:
      tags:
        - Security Attack discovery API
      summary: Enable Attack Discovery schedule
      description: 'Enables a previously disabled Attack Discovery schedule, allowing it to run according to its configured interval. Once enabled, the schedule will begin executing at the next scheduled time based on its interval configuration.'
      operationId: EnableAttackDiscoverySchedules
      parameters:
        - name: id
          in: path
          description: The unique identifier (UUID) of the Attack Discovery schedule to enable. This ID is returned when creating a schedule and can be found in schedule listings.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          example: 12345678-1234-1234-1234-123456789012
      responses:
        '200':
          description: 'Successfully enabled Attack Discovery schedule, returning the schedule ID for confirmation'
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
              examples:
                EnableAttackDiscoverySchedulesResponse200Example:
                  summary: Confirmation returned after enabling an Attack Discovery schedule.
                  value:
                    id: 12345678-1234-1234-1234-123456789012
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryGenericError'
              examples:
                EnableAttackDiscoverySchedulesResponse400Example:
                  summary: Bad Request error returned when the enable schedule request is invalid.
                  value:
                    error: Bad Request
                    message: Invalid request parameters.
                    status_code: 400
      x-codeSamples:
        - label: Enable an Attack Discovery schedule
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/attack_discovery/schedules/12345678-1234-1234-1234-123456789012/_enable' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases:
    delete:
      tags:
        - cases
      summary: Delete cases
      description: "You must have `read` or `all` privileges and the `delete` sub-feature privilege for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n"
      operationId: deleteCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_ids'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-codeSamples:
        - label: curl
          lang: curl
          source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases?ids=%5B%22030e6e34-6470-4001-864f-b229511ad188%22%2C%22e662ff34-0493-4538-b9d1-6706ced02ff2%22%5D' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"Content-Type: application/json\" \\\n  --header \"kbn-xsrf: true\"\n"
        - label: Console
          lang: console
          source: "DELETE kbn:/api/cases?ids=[\"030e6e34-6470-4001-864f-b229511ad188\",\"e662ff34-0493-4538-b9d1-6706ced02ff2\"]\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - cases
      summary: Update cases
      description: "You must have `all` privileges for the **Cases** feature in the  **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you're updating.\n"
      operationId: updateCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_update_case_request'
            examples:
              updateCaseRequest:
                $ref: '#/components/examples/Cases_update_case_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Cases_case_response_properties'
              examples:
                updateCaseResponse:
                  $ref: '#/components/examples/Cases_update_case_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - cases
      summary: Create a case
      description: "You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana  feature privileges, depending on the owner of the case you're creating.\n"
      operationId: createCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_create_case_request'
            examples:
              createCaseRequest:
                $ref: '#/components/examples/Cases_create_case_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
              examples:
                createCaseResponse:
                  $ref: '#/components/examples/Cases_create_case_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/_find:
    get:
      tags:
        - cases
      summary: Search cases
      description: "You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n"
      operationId: findCasesDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_assignees_filter'
        - $ref: '#/components/parameters/Cases_category'
        - $ref: '#/components/parameters/Cases_defaultSearchOperator'
        - $ref: '#/components/parameters/Cases_from'
        - $ref: '#/components/parameters/Cases_owner_filter'
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_reporters'
        - $ref: '#/components/parameters/Cases_search'
        - $ref: '#/components/parameters/Cases_searchFields'
        - $ref: '#/components/parameters/Cases_severity'
        - $ref: '#/components/parameters/Cases_sortField'
        - $ref: '#/components/parameters/Cases_sort_order'
        - $ref: '#/components/parameters/Cases_status'
        - $ref: '#/components/parameters/Cases_tags'
        - $ref: '#/components/parameters/Cases_to'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  cases:
                    maxItems: 10000
                    type: array
                    items:
                      $ref: '#/components/schemas/Cases_case_response_properties'
                  count_closed_cases:
                    type: integer
                  count_in_progress_cases:
                    type: integer
                  count_open_cases:
                    type: integer
                  page:
                    type: integer
                  per_page:
                    type: integer
                  total:
                    type: integer
              examples:
                findCaseResponse:
                  $ref: '#/components/examples/Cases_find_case_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}':
    get:
      tags:
        - cases
      summary: Get case information
      description: "Returns case details. The response does not include a comments property;  use the find case comments API to retrieve comments. The totalComment field  reflects the actual number of user comments on the case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n"
      operationId: getCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_case_response_get_case'
              examples:
                getDefaultCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_response'
                getDefaultObservabilityCaseResponse:
                  $ref: '#/components/examples/Cases_get_case_observability_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/alerts':
    get:
      tags:
        - cases
      summary: Get all alerts for a case
      description: "You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n"
      operationId: getCaseAlertsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Cases_alert_response_properties'
              examples:
                getCaseAlertsResponse:
                  $ref: '#/components/examples/Cases_get_case_alerts_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/comments':
    delete:
      tags:
        - cases
      summary: Delete all case comments and alerts
      description: "Deletes all comments and alerts from a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n"
      operationId: deleteCaseCommentsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-codeSamples:
        - label: curl
          lang: curl
          source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\"\n"
        - label: Console
          lang: console
          source: "DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - cases
      summary: Update a case comment or alert
      description: "You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. NOTE: You cannot change the comment type or the owner of a comment.\n"
      operationId: updateCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_update_case_comment_request'
            examples:
              updateCaseCommentRequest:
                $ref: '#/components/examples/Cases_update_comment_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
              examples:
                updateCaseCommentResponse:
                  $ref: '#/components/examples/Cases_update_comment_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - cases
      summary: Add a case comment or alert
      description: "You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're creating. NOTE: Each case can have a maximum of 1,000 alerts.\n"
      operationId: addCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_add_case_comment_request'
            examples:
              createCaseCommentRequest:
                $ref: '#/components/examples/Cases_add_comment_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
              examples:
                createCaseCommentResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/comments/_find':
    get:
      tags:
        - cases
      summary: Find case comments
      description: "Retrieves a paginated list of comments for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.\n"
      operationId: findCaseCommentsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_sort_order'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_find_comments_response'
              examples:
                findCaseCommentsResponse:
                  $ref: '#/components/examples/Cases_find_case_comments_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/comments/{commentId}':
    delete:
      tags:
        - cases
      summary: Delete a case comment or alert
      description: "You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're deleting.\n"
      operationId: deleteCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '204':
          description: Indicates a successful call.
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-codeSamples:
        - label: curl
          lang: curl
          source: "curl \\\n  --request DELETE 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\"\n"
        - label: Console
          lang: console
          source: "DELETE kbn:/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/comments/71ec1870-725b-11ea-a0b2-c51ea50a58e2\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - cases
      summary: Get a case comment or alert
      description: "You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases with the comments you're seeking.\n"
      operationId: getCaseCommentDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_comment_id'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
                  - $ref: '#/components/schemas/Cases_user_comment_response_properties'
              examples:
                getCaseCommentResponse:
                  $ref: '#/components/examples/Cases_get_comment_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/connector/{connectorId}/_push':
    post:
      tags:
        - cases
      summary: Push a case to an external service
      description: "You must have `all` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges. You must also have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're pushing.\n"
      operationId: pushCaseDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_connector_id'
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              type:
                - 'null'
                - object
            examples:
              pushCaseRequest:
                summary: Push a case to an external service. No request body is required.
                value: 'null'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
              examples:
                pushCaseResponse:
                  $ref: '#/components/examples/Cases_push_case_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/fields':
    get:
      tags:
        - cases
      summary: Get the fields applicable to an existing case
      description: "Returns the fields you can write to the case's `extended_fields`. The case determines the owner and any applied template. The response includes the owner's global fields (library-wide) and, if the case has a template, that template's fields. Requires the Cases feature to be enabled in the space.\n"
      operationId: getCaseApplicableFieldsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_applicable_fields_response'
              examples:
                getCaseApplicableFieldsResponse:
                  $ref: '#/components/examples/Cases_get_case_applicable_fields_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
        '403':
          description: The user does not have access to the case.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
        '404':
          description: The case was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/files':
    post:
      tags:
        - cases
      summary: Attach a file to a case
      description: "Attach a file to a case. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're updating. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- The location of the file that is being uploaded.\n"
      operationId: addCaseFileDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_case_id'
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Cases_add_case_file_request'
            examples:
              addCaseFileRequest:
                summary: Attach a plain text file named "my_attachment".
                value:
                  filename: my_attachment
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_case_response_properties'
              examples:
                addCaseFileResponse:
                  $ref: '#/components/examples/Cases_add_comment_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-codeSamples:
        - label: curl
          lang: curl
          source: "curl \\\n  --request POST 'https://localhost:5601/api/cases/9c235210-6834-11ea-a78c-6ffb38a34414/files' \\\n  --header \"Authorization: $API_KEY\" \\\n  --header \"kbn-xsrf: true\" \\\n  --form \"file=@/path/to/my_attachment.txt\" \\\n  --form \"filename=my_attachment\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/{caseId}/user_actions/_find':
    get:
      tags:
        - cases
      summary: Find case activity
      description: "Retrieves a paginated list of user activity for a case. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the case you're seeking.\n"
      operationId: findCaseActivityDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_case_id'
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_sort_order'
        - $ref: '#/components/parameters/Cases_user_action_types'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  userActions:
                    maxItems: 10000
                    type: array
                    items:
                      $ref: '#/components/schemas/Cases_user_actions_find_response_properties'
              examples:
                findCaseActivityResponse:
                  $ref: '#/components/examples/Cases_find_case_activity_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/alerts/{alertId}':
    get:
      tags:
        - cases
      summary: Get cases for an alert
      description: "You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n"
      operationId: getCasesByAlertDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_alert_id'
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Cases_related_case'
              examples:
                getCasesByAlertResponse:
                  summary: Cases associated with a given alert.
                  value:
                    - createdAt: '2020-02-19T23:06:33.798Z'
                      description: Investigating suspicious activity
                      id: 06116b80-e1c3-11ec-be9b-9b1838238ee6
                      status: open
                      title: security_case
                      totals:
                        alerts: 1
                        events: 0
                        userComments: 0
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/configure:
    get:
      tags:
        - cases
      summary: Get case settings
      description: "Get setting details such as the closure type, custom fields, templates, and the default connector for cases. You must have `read` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the cases were created.\n"
      operationId: getCaseConfigurationDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    closure_type:
                      $ref: '#/components/schemas/Cases_closure_types'
                    connector:
                      type: object
                      properties:
                        fields:
                          type:
                            - 'null'
                            - object
                          description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
                        id:
                          type: string
                          description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
                          example: none
                        name:
                          type: string
                          description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
                          example: none
                        type:
                          $ref: '#/components/schemas/Cases_connector_types'
                    created_at:
                      type: string
                      format: date-time
                      example: '2022-06-01T17:07:17.767Z'
                    created_by:
                      required:
                        - email
                        - full_name
                        - username
                      type: object
                      properties:
                        email:
                          type:
                            - 'null'
                            - string
                          example: 'null'
                        full_name:
                          type:
                            - 'null'
                            - string
                          example: 'null'
                        profile_uid:
                          type: string
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        username:
                          type:
                            - 'null'
                            - string
                          example: elastic
                    customFields:
                      type: array
                      items:
                        type: object
                        properties:
                          defaultValue:
                            type:
                              - boolean
                              - string
                            description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
                          key:
                            maxLength: 36
                            minLength: 1
                            type: string
                            description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
                          label:
                            maxLength: 50
                            minLength: 1
                            type: string
                            description: The custom field label that is displayed in the case.
                          type:
                            enum:
                              - text
                              - toggle
                            type: string
                            description: The type of the custom field.
                          required:
                            type: boolean
                            description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
                      description: Custom fields configuration details.
                    error:
                      type:
                        - 'null'
                        - string
                      example: 'null'
                    id:
                      type: string
                      example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                    mappings:
                      type: array
                      items:
                        type: object
                        properties:
                          action_type:
                            type: string
                            example: overwrite
                          source:
                            type: string
                            example: title
                          target:
                            type: string
                            example: summary
                    observableTypes:
                      type: array
                      items:
                        type: object
                        properties:
                          key:
                            type: string
                            description: The observable type key.
                            example: d312efda-ec2b-42ec-9e2c-84981795c581
                          label:
                            type: string
                            description: The observable type label.
                            example: My observable type
                      description: Custom observable type configuration details.
                    owner:
                      $ref: '#/components/schemas/Cases_owner'
                    templates:
                      $ref: '#/components/schemas/Cases_templates'
                    updated_at:
                      type:
                        - 'null'
                        - string
                      format: date-time
                      example: '2022-06-01T19:58:48.169Z'
                    updated_by:
                      required:
                        - email
                        - full_name
                        - username
                      type:
                        - 'null'
                        - object
                      properties:
                        email:
                          type:
                            - 'null'
                            - string
                          example: 'null'
                        full_name:
                          type:
                            - 'null'
                            - string
                          example: 'null'
                        profile_uid:
                          type: string
                          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                        username:
                          type:
                            - 'null'
                            - string
                          example: elastic
                    version:
                      type: string
                      example: WzIwNzMsMV0=
              examples:
                getConfigurationResponse:
                  $ref: '#/components/examples/Cases_get_case_configuration_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - cases
      summary: Add case settings
      description: "Case settings include external connection details, custom fields, and templates. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. If you set a default connector, it is automatically selected when you create cases in Kibana. If you use the create case API, however, you must still specify all of the connector details. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where you are creating cases.\n"
      operationId: setCaseConfigurationDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_set_case_configuration_request'
            examples:
              setCaseConfigRequest:
                $ref: '#/components/examples/Cases_set_case_configuration_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        type:
                          - 'null'
                          - object
                        description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
                      id:
                        type: string
                        description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
                        example: none
                      name:
                        type: string
                        description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
                        example: none
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    type: string
                    format: date-time
                    example: '2022-06-01T17:07:17.767Z'
                  created_by:
                    required:
                      - email
                      - full_name
                      - username
                    type: object
                    properties:
                      email:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      full_name:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      profile_uid:
                        type: string
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      username:
                        type:
                          - 'null'
                          - string
                        example: elastic
                  customFields:
                    type: array
                    items:
                      type: object
                      properties:
                        defaultValue:
                          type:
                            - boolean
                            - string
                          description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
                        key:
                          maxLength: 36
                          minLength: 1
                          type: string
                          description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
                        label:
                          maxLength: 50
                          minLength: 1
                          type: string
                          description: The custom field label that is displayed in the case.
                        type:
                          enum:
                            - text
                            - toggle
                          type: string
                          description: The type of the custom field.
                        required:
                          type: boolean
                          description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
                    description: Custom fields configuration details.
                  error:
                    type:
                      - 'null'
                      - string
                    example: 'null'
                  id:
                    type: string
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                  mappings:
                    type: array
                    items:
                      type: object
                      properties:
                        action_type:
                          type: string
                          example: overwrite
                        source:
                          type: string
                          example: title
                        target:
                          type: string
                          example: summary
                  observableTypes:
                    type: array
                    items:
                      type: object
                      properties:
                        key:
                          type: string
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                        label:
                          type: string
                          description: The observable type label.
                          example: My observable type
                    description: Custom observable type configuration details.
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    type:
                      - 'null'
                      - string
                    format: date-time
                    example: '2022-06-01T19:58:48.169Z'
                  updated_by:
                    required:
                      - email
                      - full_name
                      - username
                    type:
                      - 'null'
                      - object
                    properties:
                      email:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      full_name:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      profile_uid:
                        type: string
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      username:
                        type:
                          - 'null'
                          - string
                        example: elastic
                  version:
                    type: string
                    example: WzIwNzMsMV0=
              examples:
                setCaseConfigResponse:
                  $ref: '#/components/examples/Cases_set_case_configuration_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/configure/{configurationId}':
    patch:
      tags:
        - cases
      summary: Update case settings
      description: "Updates setting details such as the closure type, custom fields, templates, and the default connector for cases. Connectors are used to interface with external systems. You must create a connector before you can use it in your cases. You must have `all` privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on where the case was created.\n"
      operationId: updateCaseConfigurationDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_kbn_xsrf'
        - $ref: '#/components/parameters/Cases_configuration_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_update_case_configuration_request'
            examples:
              updateCaseConfigurationRequest:
                $ref: '#/components/examples/Cases_update_case_configuration_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  closure_type:
                    $ref: '#/components/schemas/Cases_closure_types'
                  connector:
                    type: object
                    properties:
                      fields:
                        type:
                          - 'null'
                          - object
                        description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
                      id:
                        type: string
                        description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
                        example: none
                      name:
                        type: string
                        description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
                        example: none
                      type:
                        $ref: '#/components/schemas/Cases_connector_types'
                  created_at:
                    type: string
                    format: date-time
                    example: '2022-06-01T17:07:17.767Z'
                  created_by:
                    required:
                      - email
                      - full_name
                      - username
                    type: object
                    properties:
                      email:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      full_name:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      profile_uid:
                        type: string
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      username:
                        type:
                          - 'null'
                          - string
                        example: elastic
                  customFields:
                    type: array
                    items:
                      type: object
                      properties:
                        defaultValue:
                          type:
                            - boolean
                            - string
                          description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
                        key:
                          maxLength: 36
                          minLength: 1
                          type: string
                          description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
                        label:
                          maxLength: 50
                          minLength: 1
                          type: string
                          description: The custom field label that is displayed in the case.
                        type:
                          enum:
                            - text
                            - toggle
                          type: string
                          description: The type of the custom field.
                        required:
                          type: boolean
                          description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
                    description: Custom fields configuration details.
                  error:
                    type:
                      - 'null'
                      - string
                    example: 'null'
                  id:
                    type: string
                    example: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
                  mappings:
                    type: array
                    items:
                      type: object
                      properties:
                        action_type:
                          type: string
                          example: overwrite
                        source:
                          type: string
                          example: title
                        target:
                          type: string
                          example: summary
                  observableTypes:
                    type: array
                    items:
                      type: object
                      properties:
                        key:
                          type: string
                          description: The observable type key.
                          example: d312efda-ec2b-42ec-9e2c-84981795c581
                        label:
                          type: string
                          description: The observable type label.
                          example: My observable type
                    description: Custom observable type configuration details.
                  owner:
                    $ref: '#/components/schemas/Cases_owner'
                  templates:
                    $ref: '#/components/schemas/Cases_templates'
                  updated_at:
                    type:
                      - 'null'
                      - string
                    format: date-time
                    example: '2022-06-01T19:58:48.169Z'
                  updated_by:
                    required:
                      - email
                      - full_name
                      - username
                    type:
                      - 'null'
                      - object
                    properties:
                      email:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      full_name:
                        type:
                          - 'null'
                          - string
                        example: 'null'
                      profile_uid:
                        type: string
                        example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                      username:
                        type:
                          - 'null'
                          - string
                        example: elastic
                  version:
                    type: string
                    example: WzIwNzMsMV0=
              examples:
                updateCaseConfigurationResponse:
                  $ref: '#/components/examples/Cases_update_case_configuration_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/configure/connectors/_find:
    get:
      tags:
        - cases
      summary: Get case connectors
      description: "Get information about connectors that are supported for use in cases. You must have `read` privileges for the **Actions and Connectors** feature in the **Management** section of the Kibana feature privileges.\n"
      operationId: findCaseConnectorsDefaultSpace
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                maxItems: 1000
                type: array
                items:
                  type: object
                  properties:
                    actionTypeId:
                      $ref: '#/components/schemas/Cases_connector_types'
                    config:
                      type: object
                      properties:
                        apiUrl:
                          type: string
                        projectKey:
                          type: string
                    id:
                      type: string
                    isDeprecated:
                      type: boolean
                    isMissingSecrets:
                      type: boolean
                    isPreconfigured:
                      type: boolean
                    name:
                      type: string
                    referencedByCount:
                      type: integer
              examples:
                findConnectorResponse:
                  $ref: '#/components/examples/Cases_find_connector_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/fields:
    get:
      tags:
        - cases
      summary: Get the fields applicable to a case
      description: "Returns the fields you can write to a case's `extended_fields` when creating a case for the given owner. Includes the owner's global (library-wide) fields and, when `templateId` is supplied, that template's fields. Migrated legacy custom fields appear as `global` fields. Requires the Cases feature to be enabled in the space.\n"
      operationId: getApplicableFieldsDefaultSpace
      parameters:
        - name: owner
          in: query
          description: 'The application that owns the cases (for example `cases`, `observability`, or `securitySolution`).'
          required: true
          schema:
            maxLength: 30
            type: string
          example: cases
        - name: templateId
          in: query
          description: The identifier of a template to include the template's fields in the response.
          schema:
            maxLength: 36
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_applicable_fields_response'
              examples:
                getCaseApplicableFieldsResponse:
                  $ref: '#/components/examples/Cases_get_case_applicable_fields_response'
        '400':
          description: 'The request is invalid, for example when the `templateId` does not exist for the owner or its definition is invalid.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_invalid_template'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
        '403':
          description: The user does not have access to the requested owner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/reporters:
    get:
      tags:
        - cases
      summary: Get case creators
      description: "Returns information about the users who opened cases. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases. The API returns information about the users as they existed at the time of the case creation, including their name, full name, and email address. If any of those details change thereafter or if a user is deleted, the information returned by this API is unchanged.\n"
      operationId: getCaseReportersDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  required:
                    - email
                    - full_name
                    - username
                  type: object
                  properties:
                    email:
                      type:
                        - 'null'
                        - string
                      example: 'null'
                    full_name:
                      type:
                        - 'null'
                        - string
                      example: 'null'
                    profile_uid:
                      type: string
                      example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
                    username:
                      type:
                        - 'null'
                        - string
                      example: elastic
              examples:
                getReportersResponse:
                  $ref: '#/components/examples/Cases_get_reporters_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/tags:
    get:
      tags:
        - cases
      summary: Get case tags
      description: "Aggregates and returns a list of case tags. You must have read privileges for the **Cases** feature in the **Management**, **Observability**, or **Security** section of the Kibana feature privileges, depending on the owner of the cases you're seeking.\n"
      operationId: getCaseTagsDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_owner_filter'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  type: string
              examples:
                getTagsResponse:
                  $ref: '#/components/examples/Cases_get_tags_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/cases/templates:
    get:
      tags:
        - cases
      summary: Get all case templates
      description: "Returns a paginated list of case templates. Requires the Cases feature to be enabled in the space.\n"
      operationId: getCaseTemplatesDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_page_index'
        - $ref: '#/components/parameters/Cases_page_size'
        - $ref: '#/components/parameters/Cases_template_sort_field'
        - $ref: '#/components/parameters/Cases_sort_order'
        - $ref: '#/components/parameters/Cases_search'
        - $ref: '#/components/parameters/Cases_owner_filter'
        - $ref: '#/components/parameters/Cases_template_tags'
        - $ref: '#/components/parameters/Cases_template_author'
        - $ref: '#/components/parameters/Cases_template_is_enabled'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_get_case_templates_response'
              examples:
                getCaseTemplatesResponse:
                  $ref: '#/components/examples/Cases_get_case_templates_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - cases
      summary: Create a case template
      description: "Creates a case template from a YAML definition. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation (body, YAML definition, name uniqueness, authorization) without creating anything. Requires the Cases feature to be enabled in the space.\n"
      operationId: createCaseTemplateDefaultSpace
      parameters:
        - name: dry_run
          in: query
          description: 'When true, validates the request without creating the template and returns `{"valid": true}`.'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_template_write_request'
            examples:
              createCaseTemplateRequest:
                $ref: '#/components/examples/Cases_template_write_request'
        required: true
      responses:
        '200':
          description: 'Indicates a successful call. Returns the created template, or `{"valid": true}` for a dry run.'
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_template_v2_response'
                  - $ref: '#/components/schemas/Cases_template_dry_run_response'
              examples:
                createCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
                dryRunResponse:
                  $ref: '#/components/examples/Cases_template_dry_run_response'
        '400':
          description: "The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 templates per owner, max 200 fields per template).\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_template_limit'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
        '403':
          description: The user does not have the manage templates privilege for the owner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
        '409':
          description: A template with the same name already exists for the owner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/cases/templates/{template_id}':
    delete:
      tags:
        - cases
      summary: Delete a case template
      description: "Soft-deletes a case template (all versions). Existing cases keep their pinned template reference; the template stops appearing in the case creation flow and in find responses. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Requires the Cases feature to be enabled in the space.\n"
      operationId: deleteCaseTemplateDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_template_id'
      responses:
        '204':
          description: The template was deleted.
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
        '403':
          description: The user does not have the manage templates privilege for the owner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
        '404':
          description: The template was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - cases
      summary: Get a case template by ID
      description: "Returns the details of a case template. Requires the Cases feature to be enabled in the space.\n"
      operationId: getCaseTemplateDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_template_id'
        - $ref: '#/components/parameters/Cases_template_version'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_template_v2_response'
              examples:
                getCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
        '404':
          description: The template was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - cases
      summary: Update a case template
      description: "Fully replaces a case template. Every accepted update creates a new template version; previous versions stay retrievable with the `version` query parameter of the get template API, and cases keep the version they were created with. You must have the \"Manage templates\" sub-privilege for the Cases feature of the owning solution. Set `dry_run=true` to run the full validation without writing. Requires the Cases feature to be enabled in the space.\n"
      operationId: updateCaseTemplateDefaultSpace
      parameters:
        - $ref: '#/components/parameters/Cases_template_id'
        - name: dry_run
          in: query
          description: 'When true, validates the request without updating the template and returns `{"valid": true}`.'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Cases_template_write_request'
            examples:
              updateCaseTemplateRequest:
                $ref: '#/components/examples/Cases_template_write_request'
        required: true
      responses:
        '200':
          description: 'Indicates a successful call. Returns the new template version, or `{"valid": true}` for a dry run.'
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Cases_template_v2_response'
                  - $ref: '#/components/schemas/Cases_template_dry_run_response'
              examples:
                dryRunResponse:
                  $ref: '#/components/examples/Cases_template_dry_run_response'
                updateCaseTemplateResponse:
                  $ref: '#/components/examples/Cases_get_case_template_response'
        '400':
          description: "The request body, YAML definition, or template name is invalid, or a resource limit was exceeded (max 200 fields per template).\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response400:
                  $ref: '#/components/examples/Cases_response_400_template_limit'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response401:
                  $ref: '#/components/examples/Cases_response_401'
        '403':
          description: The user does not have the manage templates privilege for the owner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response403:
                  $ref: '#/components/examples/Cases_response_403'
        '404':
          description: The template was not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response404:
                  $ref: '#/components/examples/Cases_response_404'
        '409':
          description: A template with the same name already exists for the owner.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Cases_response_4xx'
              examples:
                response409:
                  $ref: '#/components/examples/Cases_response_409'
      x-state: Technical preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/dashboards:
    get:
      tags:
        - Dashboards
      summary: Search dashboards
      description: 'Returns a paginated list of dashboards. Each result includes title, description, tags, and metadata, but not the full panel layout. Use `GET /api/dashboards/{id}` to retrieve the complete state.'
      operationId: search-dashboards
      parameters:
        - name: page
          in: query
          description: The page of results to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of results to return per page.
          schema:
            maximum: 1000
            minimum: 1
            type: number
            default: 20
        - name: query
          in: query
          description: 'Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.'
          schema:
            type: string
        - name: tags
          in: query
          description: 'A tag ID to include. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are included.'
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 250
              type: string
            description: Tag IDs associated with this dashboard.
            default: [ ]
        - name: excluded_tags
          in: query
          description: 'A tag ID to exclude. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are excluded.'
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 250
              type: string
            description: Tag IDs associated with this dashboard.
            default: [ ]
        - name: tag_names
          in: query
          description: 'A tag name to include. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are included. If the same name is shared by multiple tags, items matching any of those tags are included.'
          schema:
            maxItems: 100
            type: array
            items:
              type: string
            x-state: Generally available; added in 9.6.0
        - name: excluded_tag_names
          in: query
          description: 'A tag name to exclude. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are excluded. If the same name is shared by multiple tags, items matching any of those tags are excluded.'
          schema:
            maxItems: 100
            type: array
            items:
              type: string
            x-state: Generally available; added in 9.6.0
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - data
                  - meta
                type: object
                properties:
                  data:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - id
                        - data
                        - meta
                      type: object
                      properties:
                        data:
                          required:
                            - title
                          type: object
                          properties:
                            access_control:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-access-control'
                            description:
                              type: string
                              description: A short description of the dashboard.
                            tags:
                              maxItems: 100
                              type: array
                              items:
                                maxLength: 250
                                type: string
                              description: Tag IDs associated with this dashboard.
                              default: [ ]
                            time_range:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
                            title:
                              type: string
                              description: The dashboard title.
                          additionalProperties: false
                        id:
                          type: string
                          description: The dashboard ID.
                        meta:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                      additionalProperties: false
                    description: List of dashboards matching the query. Each entry includes summary fields but not the full panel layout.
                  meta:
                    required:
                      - total
                    type: object
                    properties:
                      page:
                        minimum: 1
                        type: number
                        description: The returned page of results.
                        default: 1
                      per_page:
                        maximum: 1000
                        minimum: 1
                        type: number
                        description: The number of results returned per page.
                        default: 20
                      total:
                        type: number
                        description: The total number of results matching the query.
                    additionalProperties: false
                additionalProperties: false
              examples:
                searchDashboardsResponse:
                  summary: Search dashboards response
                  description: "Paginated list of dashboard summaries. Each item includes the ID, a subset of dashboard state fields (`title`, `time_range` if set), and metadata. Full panel content is not included - use the GET endpoint to retrieve a specific dashboard.\n"
                  value:
                    data:
                      - data:
                          title: Web logs overview
                        id: 3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b
                        meta:
                          created_at: '2026-04-13T10:00:00.000Z'
                          managed: false
                          updated_at: '2026-04-13T10:00:00.000Z'
                          version: WzEwMiwxXQ==
                      - data:
                          time_range:
                            from: now-7d
                            to: now
                          title: Operations overview
                        id: 7f2a1c40-e83b-11ef-a641-7d5b3f9e1c2a
                        meta:
                          created_at: '2026-04-12T08:00:00.000Z'
                          managed: false
                          updated_at: '2026-04-12T14:22:00.000Z'
                          version: WzEwMSwxXQ==
                    meta:
                      page: 1
                      per_page: 20
                      total: 2
        '400':
          description: bad request
        '403':
          description: forbidden
        '500':
          description: internal server error
      x-codeSamples:
        - label: Search dashboards - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/dashboards?query=web+logs&per_page=10\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Search dashboards - Console
          lang: Console
          source: "GET kbn:/api/dashboards?query=web+logs&per_page=10\n"
        - label: Filter by tag name - cURL
          lang: cURL_tag_names
          source: "curl -X GET \"${KIBANA_URL}/api/dashboards?tag_names=Security&tag_names=Observability\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Filter by tag name - Console
          lang: Console_tag_names
          source: "GET kbn:/api/dashboards?tag_names=Security&tag_names=Observability\n"
        - label: Exclude by tag name - cURL
          lang: cURL_excluded_tag_names
          source: "curl -X GET \"${KIBANA_URL}/api/dashboards?excluded_tag_names=Deprecated\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Exclude by tag name - Console
          lang: Console_excluded_tag_names
          source: "GET kbn:/api/dashboards?excluded_tag_names=Deprecated\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Dashboards
      summary: Create a dashboard
      description: 'Creates a new dashboard and returns its ID, full state, and metadata.'
      operationId: create-dashboard
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-data'
      responses:
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-data'
                  id:
                    type: string
                    description: 'The unique ID of the dashboard, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                createDashboardResponse:
                  summary: Create dashboard response
                  description: "Response to creating a dashboard. Returns the generated ID, the full dashboard state in `data`, and metadata. Default option values are always returned even when not explicitly set in the request. Panel `id` values are generated automatically.\n"
                  value:
                    data:
                      access_control:
                        access_mode: write_restricted
                      options:
                        auto_apply_filters: true
                        hide_panel_borders: false
                        hide_panel_titles: false
                        sync_colors: false
                        sync_cursor: true
                        sync_tooltips: false
                        use_margins: true
                      panels:
                        - config:
                            content: '## Web logs overview'
                          grid:
                            h: 15
                            w: 24
                            x: 0
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000001
                          type: markdown
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - empty_as_null: false
                                operation: count
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: ''
                            type: metric
                          grid:
                            h: 5
                            w: 12
                            x: 24
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000002
                          type: vis
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - field: bytes
                                operation: average
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: ''
                            type: metric
                          grid:
                            h: 5
                            w: 12
                            x: 36
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000003
                          type: vis
                        - config:
                            axis:
                              x:
                                domain:
                                  rounding: false
                                  type: fit
                                grid:
                                  visible: true
                                labels:
                                  orientation: horizontal
                                scale: ordinal
                                ticks:
                                  visible: true
                                title:
                                  visible: false
                              y:
                                anchor: start
                                domain:
                                  rounding: true
                                  type: full
                                grid:
                                  visible: true
                                labels:
                                  orientation: horizontal
                                scale: linear
                                ticks:
                                  visible: true
                                title:
                                  visible: true
                            layers:
                              - data_source:
                                  query: 'FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)'
                                  type: esql
                                ignore_global_filters: false
                                sampling: 1
                                type: line
                                x:
                                  column: 'BUCKET(@timestamp, 75, ?_tstart, ?_tend)'
                                y:
                                  - axis_id: y
                                    column: count
                            legend:
                              layout:
                                truncate:
                                  max_lines: 1
                                type: grid
                              placement: outside
                              position: right
                              visibility: hidden
                            styling:
                              interpolation: linear
                              overlays:
                                current_time_marker:
                                  visible: false
                                partial_buckets:
                                  visible: false
                              points:
                                visibility: auto
                            title: Requests over time
                            type: xy
                          grid:
                            h: 10
                            w: 24
                            x: 24
                            y: 5
                          id: a1b2c3d4-0001-4000-8000-000000000003
                          type: vis
                      pinned_panels: [ ]
                      title: Web logs overview
                    id: 3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzEwMiwxXQ==
        '400':
          description: invalid request
        '403':
          description: forbidden
      x-codeSamples:
        - label: Create a dashboard (simple) - cURL
          lang: cURL_simple
          source: "curl -X POST \"${KIBANA_URL}/api/dashboards\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Web logs overview\",\n  \"access_control\": {\n    \"access_mode\": \"write_restricted\"\n  },\n  \"panels\": [\n    {\n      \"grid\": {\n        \"x\": 0,\n        \"y\": 0,\n        \"w\": 24,\n        \"h\": 15\n      },\n      \"type\": \"markdown\",\n      \"config\": {\n        \"content\": \"## Web logs overview\\n\\n&nbsp;\\n\\nCreated with the [Dashboards API](https://www.elastic.co/docs/api/doc/kibana) using the Kibana sample web logs dataset (`kibana_sample_data_logs`). Contains:\\n- This markdown panel\\n- 2 metrics, showing request count and average response size\\n- A line chart based on an ES|QL query\\n\\n&nbsp;\\n\\n&nbsp;\\n\\n[Learn more about dashboards](https://www.elastic.co/docs/explore-analyze/dashboards)\"\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 24,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"count\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 36,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"average\",\n            \"field\": \"bytes\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 24,\n        \"y\": 5,\n        \"w\": 24,\n        \"h\": 10\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"xy\",\n        \"title\": \"Requests over time\",\n        \"layers\": [\n          {\n            \"type\": \"line\",\n            \"data_source\": {\n              \"type\": \"esql\",\n              \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"x\": {\n              \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"y\": [\n              {\n                \"column\": \"count\"\n              }\n            ]\n          }\n        ],\n        \"axis\": {\n          \"x\": {\n            \"title\": {\n              \"visible\": false\n            }\n          }\n        }\n      }\n    }\n  ]\n}'\n"
        - label: Create a dashboard (simple) - Console
          lang: Console_simple
          source: "POST kbn:/api/dashboards\n{\n  \"title\": \"Web logs overview\",\n  \"panels\": [\n    {\n      \"grid\": {\n        \"x\": 0,\n        \"y\": 0,\n        \"w\": 24,\n        \"h\": 15\n      },\n      \"type\": \"markdown\",\n      \"config\": {\n        \"content\": \"## Web logs overview\\n\\n&nbsp;\\n\\nCreated with the [Dashboards API](https://www.elastic.co/docs/api/doc/kibana) using the Kibana sample web logs dataset (`kibana_sample_data_logs`). Contains:\\n- This markdown panel\\n- 2 metrics, showing request count and average response size\\n- A line chart based on an ES|QL query\\n\\n&nbsp;\\n\\n&nbsp;\\n\\n[Learn more about dashboards](https://www.elastic.co/docs/explore-analyze/dashboards)\"\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 24,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"count\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 36,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"average\",\n            \"field\": \"bytes\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 24,\n        \"y\": 5,\n        \"w\": 24,\n        \"h\": 10\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"xy\",\n        \"title\": \"Requests over time\",\n        \"layers\": [\n          {\n            \"type\": \"line\",\n            \"data_source\": {\n              \"type\": \"esql\",\n              \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"x\": {\n              \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"y\": [\n              {\n                \"column\": \"count\"\n              }\n            ]\n          }\n        ],\n        \"axis\": {\n          \"x\": {\n            \"title\": {\n              \"visible\": false\n            }\n          }\n        }\n      }\n    }\n  ]\n}\n"
        - label: Create a dashboard (with sections and controls) - cURL
          lang: cURL_Sections
          source: "curl -X POST \"${KIBANA_URL}/api/dashboards\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Operations overview\",\n  \"time_range\": {\n    \"from\": \"now-7d\",\n    \"to\": \"now\"\n  },\n  \"pinned_panels\": [\n    {\n      \"type\": \"options_list_control\",\n      \"width\": \"medium\",\n      \"grow\": true,\n      \"config\": {\n        \"title\": \"Response code\",\n        \"data_view_id\": \"90943e30-9a47-11e8-b64d-95841ca0b247\",\n        \"field_name\": \"response.keyword\"\n      }\n    }\n  ],\n  \"panels\": [\n    {\n      \"title\": \"Key metrics\",\n      \"collapsed\": false,\n      \"grid\": {\n        \"y\": 0\n      },\n      \"panels\": [\n        {\n          \"grid\": {\n            \"x\": 0,\n            \"y\": 0,\n            \"w\": 12,\n            \"h\": 5\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"metric\",\n            \"data_source\": {\n              \"type\": \"data_view_spec\",\n              \"index_pattern\": \"kibana_sample_data_logs\",\n              \"time_field\": \"timestamp\"\n            },\n            \"metrics\": [\n              {\n                \"type\": \"primary\",\n                \"operation\": \"count\"\n              }\n            ]\n          }\n        },\n        {\n          \"grid\": {\n            \"x\": 12,\n            \"y\": 0,\n            \"w\": 12,\n            \"h\": 5\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"metric\",\n            \"data_source\": {\n              \"type\": \"data_view_spec\",\n              \"index_pattern\": \"kibana_sample_data_logs\",\n              \"time_field\": \"timestamp\"\n            },\n            \"metrics\": [\n              {\n                \"type\": \"primary\",\n                \"operation\": \"average\",\n                \"field\": \"bytes\"\n              }\n            ]\n          }\n        }\n      ]\n    },\n    {\n      \"title\": \"Traffic trends\",\n      \"collapsed\": false,\n      \"grid\": {\n        \"y\": 8\n      },\n      \"panels\": [\n        {\n          \"grid\": {\n            \"x\": 0,\n            \"y\": 0,\n            \"w\": 24,\n            \"h\": 10\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"xy\",\n            \"title\": \"Requests over time\",\n            \"layers\": [\n              {\n                \"type\": \"line\",\n                \"data_source\": {\n                  \"type\": \"data_view_spec\",\n                  \"index_pattern\": \"kibana_sample_data_logs\",\n                  \"time_field\": \"timestamp\"\n                },\n                \"x\": {\n                  \"operation\": \"date_histogram\",\n                  \"field\": \"timestamp\"\n                },\n                \"y\": [\n                  {\n                    \"operation\": \"count\"\n                  }\n                ]\n              }\n            ],\n            \"axis\": {\n              \"x\": {\n                \"title\": {\n                  \"visible\": false\n                }\n              }\n            }\n          }\n        },\n        {\n          \"grid\": {\n            \"x\": 24,\n            \"y\": 0,\n            \"w\": 24,\n            \"h\": 10\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"xy\",\n            \"title\": \"Requests over time (ES|QL)\",\n            \"layers\": [\n              {\n                \"type\": \"line\",\n                \"data_source\": {\n                  \"type\": \"esql\",\n                  \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n                },\n                \"x\": {\n                  \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n                },\n                \"y\": [\n                  {\n                    \"column\": \"count\"\n                  }\n                ]\n              }\n            ],\n            \"axis\": {\n              \"x\": {\n                \"title\": {\n                  \"visible\": false\n                }\n              }\n            }\n          }\n        }\n      ]\n    }\n  ]\n}'\n"
        - label: Create a dashboard (with sections and controls) - Console
          lang: Console_sections
          source: "POST kbn:/api/dashboards\n{\n  \"title\": \"Operations overview\",\n  \"time_range\": {\n    \"from\": \"now-7d\",\n    \"to\": \"now\"\n  },\n  \"pinned_panels\": [\n    {\n      \"type\": \"options_list_control\",\n      \"width\": \"medium\",\n      \"grow\": true,\n      \"config\": {\n        \"title\": \"Response code\",\n        \"data_view_id\": \"90943e30-9a47-11e8-b64d-95841ca0b247\",\n        \"field_name\": \"response.keyword\"\n      }\n    }\n  ],\n  \"panels\": [\n    {\n      \"title\": \"Key metrics\",\n      \"collapsed\": false,\n      \"grid\": {\n        \"y\": 0\n      },\n      \"panels\": [\n        {\n          \"grid\": {\n            \"x\": 0,\n            \"y\": 0,\n            \"w\": 12,\n            \"h\": 5\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"metric\",\n            \"data_source\": {\n              \"type\": \"data_view_spec\",\n              \"index_pattern\": \"kibana_sample_data_logs\",\n              \"time_field\": \"timestamp\"\n            },\n            \"metrics\": [\n              {\n                \"type\": \"primary\",\n                \"operation\": \"count\"\n              }\n            ]\n          }\n        },\n        {\n          \"grid\": {\n            \"x\": 12,\n            \"y\": 0,\n            \"w\": 12,\n            \"h\": 5\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"metric\",\n            \"data_source\": {\n              \"type\": \"data_view_spec\",\n              \"index_pattern\": \"kibana_sample_data_logs\",\n              \"time_field\": \"timestamp\"\n            },\n            \"metrics\": [\n              {\n                \"type\": \"primary\",\n                \"operation\": \"average\",\n                \"field\": \"bytes\"\n              }\n            ]\n          }\n        }\n      ]\n    },\n    {\n      \"title\": \"Traffic trends\",\n      \"collapsed\": false,\n      \"grid\": {\n        \"y\": 8\n      },\n      \"panels\": [\n        {\n          \"grid\": {\n            \"x\": 0,\n            \"y\": 0,\n            \"w\": 24,\n            \"h\": 10\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"xy\",\n            \"title\": \"Requests over time\",\n            \"layers\": [\n              {\n                \"type\": \"line\",\n                \"data_source\": {\n                  \"type\": \"data_view_spec\",\n                  \"index_pattern\": \"kibana_sample_data_logs\",\n                  \"time_field\": \"timestamp\"\n                },\n                \"x\": {\n                  \"operation\": \"date_histogram\",\n                  \"field\": \"timestamp\"\n                },\n                \"y\": [\n                  {\n                    \"operation\": \"count\"\n                  }\n                ]\n              }\n            ],\n            \"axis\": {\n              \"x\": {\n                \"title\": {\n                  \"visible\": false\n                }\n              }\n            }\n          }\n        },\n        {\n          \"grid\": {\n            \"x\": 24,\n            \"y\": 0,\n            \"w\": 24,\n            \"h\": 10\n          },\n          \"type\": \"vis\",\n          \"config\": {\n            \"type\": \"xy\",\n            \"title\": \"Requests over time (ES|QL)\",\n            \"layers\": [\n              {\n                \"type\": \"line\",\n                \"data_source\": {\n                  \"type\": \"esql\",\n                  \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n                },\n                \"x\": {\n                  \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n                },\n                \"y\": [\n                  {\n                    \"column\": \"count\"\n                  }\n                ]\n              }\n            ],\n            \"axis\": {\n              \"x\": {\n                \"title\": {\n                  \"visible\": false\n                }\n              }\n            }\n          }\n        }\n      ]\n    }\n  ]\n}\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/dashboards/{id}':
    delete:
      tags:
        - Dashboards
      summary: Delete a dashboard
      description: Permanently deletes a dashboard by ID.
      operationId: delete-dashboard
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The dashboard ID, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      responses:
        '200':
          description: deleted
        '403':
          description: forbidden
        '404':
          description: not found
        '500':
          description: internal server error
      x-codeSamples:
        - label: Delete a dashboard - cURL
          lang: cURL
          source: "curl -X DELETE \"${KIBANA_URL}/api/dashboards/3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - label: Delete a dashboard - Console
          lang: Console
          source: "DELETE kbn:/api/dashboards/3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Dashboards
      summary: Get a dashboard
      description: Returns the complete state of a dashboard by ID.
      operationId: get-dashboard
      parameters:
        - name: id
          in: path
          description: 'The dashboard ID, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-data'
                  id:
                    type: string
                    description: 'The unique ID of the dashboard, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                  warnings:
                    maxItems: 100
                    type: array
                    items:
                      anyOf:
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-dropped-panel-warning'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-dropped-property-warning'
                    description: A list of warnings returned by the Dashboards API. Present only when one or more dashboard properties failed validation.
                additionalProperties: false
              examples:
                getDashboardResponse:
                  summary: Get dashboard response
                  description: "The full dashboard state including all panels, options, and metadata.\n"
                  value:
                    data:
                      options:
                        auto_apply_filters: true
                        hide_panel_borders: false
                        hide_panel_titles: false
                        sync_colors: false
                        sync_cursor: true
                        sync_tooltips: false
                        use_margins: true
                      panels:
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - empty_as_null: false
                                operation: count
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: Total requests
                            type: metric
                          grid:
                            h: 8
                            w: 12
                            x: 0
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000001
                          type: vis
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - field: bytes
                                operation: average
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: Average response size
                            type: metric
                          grid:
                            h: 8
                            w: 12
                            x: 12
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000002
                          type: vis
                        - config:
                            axis:
                              x:
                                domain:
                                  rounding: false
                                  type: fit
                                grid:
                                  visible: true
                                labels:
                                  orientation: horizontal
                                scale: ordinal
                                ticks:
                                  visible: true
                                title:
                                  visible: false
                              y:
                                anchor: start
                                domain:
                                  rounding: true
                                  type: full
                                grid:
                                  visible: true
                                labels:
                                  orientation: horizontal
                                scale: linear
                                ticks:
                                  visible: true
                                title:
                                  visible: true
                            layers:
                              - data_source:
                                  query: 'FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)'
                                  type: esql
                                ignore_global_filters: false
                                sampling: 1
                                type: line
                                x:
                                  column: 'BUCKET(@timestamp, 75, ?_tstart, ?_tend)'
                                y:
                                  - axis_id: y
                                    column: count
                            legend:
                              layout:
                                truncate:
                                  max_lines: 1
                                type: grid
                              placement: outside
                              position: right
                              visibility: hidden
                            styling:
                              interpolation: linear
                              overlays:
                                current_time_marker:
                                  visible: false
                                partial_buckets:
                                  visible: false
                              points:
                                visibility: auto
                            title: Requests over time
                            type: xy
                          grid:
                            h: 10
                            w: 24
                            x: 0
                            y: 15
                          id: a1b2c3d4-0001-4000-8000-000000000003
                          type: vis
                      pinned_panels: [ ]
                      title: Web logs overview
                    id: 3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzEwMiwxXQ==
        '400':
          description: invalid response
        '403':
          description: forbidden
        '404':
          description: not found
        '500':
          description: internal server error
      x-codeSamples:
        - label: Get a dashboard - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/dashboards/3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Get a dashboard - Console
          lang: Console
          source: "GET kbn:/api/dashboards/3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Dashboards
      summary: Upsert a dashboard
      description: "Creates a new dashboard with the given ID if none exists, or replaces the complete state of an\nexisting one.\n\n> warn\n> This is a full replacement. Any panels not included in the request body are permanently\n> removed. To make targeted changes, retrieve the current state first with\n> GET /api/dashboards/{id}, apply your changes, and submit the full updated object.\n\nYou can optionally include `access_control.access_mode` to change the dashboard access mode.\nIf the authenticated user is not authorized to change access mode for the target dashboard,\nthe request returns a `403` response with a descriptive `message`.\n"
      operationId: upsert-dashboard
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The unique ID of the dashboard to be created or updated
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-data'
      responses:
        '200':
          description: updated
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-data'
                  id:
                    type: string
                    description: 'The unique ID of the dashboard, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                updateDashboardResponse:
                  summary: Update dashboard response
                  description: "The complete updated dashboard state after a full replacement. Note that `meta.created_at` is not returned in update responses - use the GET endpoint to retrieve it.\n"
                  value:
                    data:
                      options:
                        auto_apply_filters: true
                        hide_panel_borders: false
                        hide_panel_titles: false
                        sync_colors: false
                        sync_cursor: true
                        sync_tooltips: false
                        use_margins: true
                      panels:
                        - config:
                            content: "## Web logs overview\n\n&nbsp;\n\nCreated with the [Dashboards API](https://www.elastic.co/docs/api/doc/kibana) using the Kibana sample web logs dataset (`kibana_sample_data_logs`). Contains:\n- This markdown panel\n- 2 metrics, showing request count and average response size\n- A line chart based on an ES|QL query\n\n&nbsp;\n\n&nbsp;\n\n[Learn more about dashboards](https://www.elastic.co/docs/explore-analyze/dashboards)"
                          grid:
                            h: 15
                            w: 24
                            x: 0
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000001
                          type: markdown
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - empty_as_null: false
                                operation: count
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: ''
                            type: metric
                          grid:
                            h: 5
                            w: 12
                            x: 24
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000002
                          type: vis
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - field: bytes
                                operation: average
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: ''
                            type: metric
                          grid:
                            h: 5
                            w: 12
                            x: 36
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000003
                          type: vis
                        - config:
                            axis:
                              x:
                                domain:
                                  rounding: false
                                  type: fit
                                grid:
                                  visible: true
                                labels:
                                  orientation: horizontal
                                scale: ordinal
                                ticks:
                                  visible: true
                                title:
                                  visible: false
                              y:
                                anchor: start
                                domain:
                                  rounding: true
                                  type: full
                                grid:
                                  visible: true
                                labels:
                                  orientation: horizontal
                                scale: linear
                                ticks:
                                  visible: true
                                title:
                                  visible: true
                            layers:
                              - data_source:
                                  query: 'FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)'
                                  type: esql
                                ignore_global_filters: false
                                sampling: 1
                                type: line
                                x:
                                  column: 'BUCKET(@timestamp, 75, ?_tstart, ?_tend)'
                                y:
                                  - axis_id: y
                                    column: count
                            legend:
                              layout:
                                truncate:
                                  max_lines: 1
                                type: grid
                              placement: outside
                              position: right
                              visibility: hidden
                            styling:
                              interpolation: linear
                              overlays:
                                current_time_marker:
                                  visible: false
                                partial_buckets:
                                  visible: false
                              points:
                                visibility: auto
                            title: Requests over time
                            type: xy
                          grid:
                            h: 10
                            w: 24
                            x: 24
                            y: 5
                          id: a1b2c3d4-0001-4000-8000-000000000003
                          type: vis
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - empty_as_null: false
                                field: clientip
                                operation: unique_count
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: Unique visitors
                            type: metric
                          grid:
                            h: 10
                            w: 24
                            x: 24
                            y: 8
                          id: a1b2c3d4-0001-4000-8000-000000000004
                          type: vis
                      pinned_panels: [ ]
                      title: Web logs overview
                    id: 3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b
                    meta:
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzEwMywxXQ==
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-data'
                  id:
                    type: string
                    description: 'The unique ID of the dashboard, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                createDashboardResponse:
                  summary: Create dashboard response (PUT)
                  description: "Response when PUT creates a new dashboard (no existing dashboard with the given ID). Returns the generated state and metadata. Default option values are always returned even when not explicitly set in the request.\n"
                  value:
                    data:
                      options:
                        auto_apply_filters: true
                        hide_panel_borders: false
                        hide_panel_titles: false
                        sync_colors: false
                        sync_cursor: true
                        sync_tooltips: false
                        use_margins: true
                      panels:
                        - config:
                            data_source:
                              index_pattern: kibana_sample_data_logs
                              time_field: timestamp
                              type: data_view_spec
                            ignore_global_filters: false
                            metrics:
                              - empty_as_null: false
                                operation: count
                                type: primary
                            sampling: 1
                            styling:
                              primary:
                                labels:
                                  alignment: left
                                position: bottom
                                value:
                                  alignment: right
                                  sizing: auto
                            title: ''
                            type: metric
                          grid:
                            h: 5
                            w: 12
                            x: 0
                            y: 0
                          id: a1b2c3d4-0001-4000-8000-000000000001
                          type: vis
                      pinned_panels: [ ]
                      title: Web logs overview
                    id: 3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzEwMiwxXQ==
        '400':
          description: invalid request
        '403':
          description: forbidden
        '409':
          description: conflict
      x-codeSamples:
        - label: Update a dashboard - cURL
          lang: cURL
          source: "curl -X PUT \"${KIBANA_URL}/api/dashboards/3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Web logs overview\",\n  \"panels\": [\n    {\n      \"grid\": {\n        \"x\": 0,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"count\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 12,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"average\",\n            \"field\": \"bytes\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 0,\n        \"y\": 8,\n        \"w\": 24,\n        \"h\": 10\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"xy\",\n        \"title\": \"Requests over time\",\n        \"layers\": [\n          {\n            \"type\": \"line\",\n            \"data_source\": {\n              \"type\": \"esql\",\n              \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"x\": {\n              \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"y\": [\n              {\n                \"column\": \"count\"\n              }\n            ]\n          }\n        ],\n        \"axis\": {\n          \"x\": {\n            \"title\": {\n              \"visible\": false\n            }\n          }\n        }\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 24,\n        \"y\": 8,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"unique_count\",\n            \"field\": \"clientip\"\n          }\n        ]\n      }\n    }\n  ]\n}'\n"
        - label: Update a dashboard - Console
          lang: Console
          source: "PUT kbn:/api/dashboards/3c4b8e10-d57a-11ef-9a52-4f3c2a8d0e1b\n{\n  \"title\": \"Web logs overview\",\n  \"panels\": [\n    {\n      \"grid\": {\n        \"x\": 0,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"count\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 12,\n        \"y\": 0,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"average\",\n            \"field\": \"bytes\"\n          }\n        ]\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 0,\n        \"y\": 8,\n        \"w\": 24,\n        \"h\": 10\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"xy\",\n        \"title\": \"Requests over time\",\n        \"layers\": [\n          {\n            \"type\": \"line\",\n            \"data_source\": {\n              \"type\": \"esql\",\n              \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"x\": {\n              \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n            },\n            \"y\": [\n              {\n                \"column\": \"count\"\n              }\n            ]\n          }\n        ],\n        \"axis\": {\n          \"x\": {\n            \"title\": {\n              \"visible\": false\n            }\n          }\n        }\n      }\n    },\n    {\n      \"grid\": {\n        \"x\": 24,\n        \"y\": 8,\n        \"w\": 12,\n        \"h\": 5\n      },\n      \"type\": \"vis\",\n      \"config\": {\n        \"type\": \"metric\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"metrics\": [\n          {\n            \"type\": \"primary\",\n            \"operation\": \"unique_count\",\n            \"field\": \"clientip\"\n          }\n        ]\n      }\n    }\n  ]\n}\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views:
    get:
      tags:
        - data views
      summary: Get all data views
      description: "Retrieve a list of all data views. Use this endpoint to identify available data views in the current Kibana space.\n"
      operationId: getAllDataViewsDefault
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data_view:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        name:
                          type: string
                        namespaces:
                          type: array
                          items:
                            type: string
                        title:
                          type: string
                        typeMeta:
                          type: object
              examples:
                getAllDataViewsResponse:
                  $ref: '#/components/examples/Data_views_get_data_views_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                getAllDataViewsBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/data_views\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/data_view:
    post:
      tags:
        - data views
      summary: Create a data view
      description: "Create a data view. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the [data views documentation](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views).\n"
      operationId: createDataViewDefaultw
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Data_views_create_data_view_request_object'
            examples:
              createDataViewRequest:
                $ref: '#/components/examples/Data_views_create_data_view_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_data_view_response_object'
              examples:
                createDataViewResponse:
                  $ref: '#/components/examples/Data_views_create_data_view_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                createDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/data_view\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"data_view\":{\"title\":\"logstash-*\",\"name\":\"My Logstash data view\"}}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/data_view\n{\"data_view\":{\"title\":\"logstash-*\",\"name\":\"My Logstash data view\"}}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/data_views/data_view/{viewId}':
    delete:
      tags:
        - data views
      summary: Delete a data view
      description: "Delete a data view by its identifier. WARNING: When you delete a data view, it cannot be recovered.\n"
      operationId: deleteDataViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '204':
          description: Indicates a successful call.
        '404':
          description: Object is not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
              examples:
                deleteDataViewNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/data_views/data_view/{viewId}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - data views
      summary: Get a data view
      description: "Retrieve a single data view by its identifier. Data views identify the Elasticsearch data you want to explore and visualize. They can point to one or more data streams, indices, or index aliases, and use optional runtime fields to compute values at query time. Note that data views are not required for ES|QL-based visualizations. To learn more, refer to the [data views documentation](https://www.elastic.co/docs/explore-analyze/find-and-organize/data-views).\n"
      operationId: getDataViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_data_view_response_object'
              examples:
                getDataViewResponse:
                  $ref: '#/components/examples/Data_views_get_data_view_response'
        '404':
          description: Object is not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
              examples:
                getDataViewNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/data_views/data_view/{viewId}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - data views
      summary: Update a data view
      description: "Update an existing data view. Only the fields provided in the request body are updated.\n"
      operationId: updateDataViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Data_views_update_data_view_request_object'
            examples:
              updateDataViewRequest:
                $ref: '#/components/examples/Data_views_update_data_view_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_data_view_response_object'
              examples:
                updateDataViewResponse:
                  $ref: '#/components/examples/Data_views_get_data_view_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                updateDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"data_view\":{\"name\":\"Updated data view name\"}}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/data_view/{viewId}\n{\"data_view\":{\"name\":\"Updated data view name\"}}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/data_views/data_view/{viewId}/fields':
    post:
      tags:
        - data views
      summary: Update field metadata
      description: "Update field metadata for a data view. Use this endpoint to set custom labels, custom descriptions, and format overrides for individual fields.\n"
      operationId: updateFieldsMetadataDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - fields
              type: object
              properties:
                fields:
                  type: object
                  description: The field object.
            examples:
              updateFieldsMetadataRequest:
                $ref: '#/components/examples/Data_views_update_field_metadata_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
              examples:
                updateFieldsMetadataResponse:
                  $ref: '#/components/examples/Data_views_update_field_metadata_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                updateFieldsMetadataBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/fields\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"fields\":{\"field_name\":{\"customLabel\":\"My custom label\"}}}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/data_view/{viewId}/fields\n{\"fields\":{\"field_name\":{\"customLabel\":\"My custom label\"}}}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/data_views/data_view/{viewId}/runtime_field':
    post:
      tags:
        - data views
      summary: Create a runtime field
      description: "Create a runtime field for a data view. Runtime fields are computed at query time using a [Painless script](https://www.elastic.co/docs/explore-analyze/scripting/modules-scripting-painless) and do not require reindexing. If no `script` is provided, the runtime field returns the corresponding value from the document `_source`.\n"
      operationId: createRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - runtimeField
              type: object
              properties:
                name:
                  type: string
                  description: "The name for a runtime field.\n"
                runtimeField:
                  type: object
                  description: "The runtime field definition object.\n"
            examples:
              createRuntimeFieldRequest:
                $ref: '#/components/examples/Data_views_create_runtime_field_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
              examples:
                createRuntimeFieldResponse:
                  $ref: '#/components/examples/Data_views_create_runtime_field_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\":\"hour_of_day\",\"runtimeField\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['\"'\"'timestamp'\"'\"'].value.getHour())\"}}}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/data_view/{viewId}/runtime_field\n{\"name\":\"hour_of_day\",\"runtimeField\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['timestamp'].value.getHour())\"}}}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - data views
      summary: Create or update a runtime field
      description: "Create or update a runtime field for a data view. If the runtime field already exists, it is replaced with the new definition.\n"
      operationId: createUpdateRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
        - name: viewId
          in: path
          description: "The ID of the data view fields you want to update.\n"
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - runtimeField
              type: object
              properties:
                name:
                  type: string
                  description: "The name for a runtime field.\n"
                runtimeField:
                  type: object
                  description: "The runtime field definition object.\n"
            examples:
              updateRuntimeFieldRequest:
                $ref: '#/components/examples/Data_views_create_runtime_field_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data_view:
                    type: object
                  fields:
                    type: array
                    items:
                      type: object
              examples:
                createUpdateRuntimeFieldResponse:
                  $ref: '#/components/examples/Data_views_create_runtime_field_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                createUpdateRuntimeFieldBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"name\":\"hour_of_day\",\"runtimeField\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['\"'\"'timestamp'\"'\"'].value.getHour())\"}}}'\n"
        - lang: Console
          source: "PUT kbn://api/data_views/data_view/{viewId}/runtime_field\n{\"name\":\"hour_of_day\",\"runtimeField\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['timestamp'].value.getHour())\"}}}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/data_views/data_view/{viewId}/runtime_field/{fieldName}':
    delete:
      tags:
        - data views
      summary: Delete a runtime field
      description: "Delete a runtime field from a data view.\n"
      operationId: deleteRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_field_name'
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '200':
          description: Indicates a successful call.
        '404':
          description: Object is not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
              examples:
                deleteRuntimeFieldNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field/${FIELD_NAME}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/data_views/data_view/{viewId}/runtime_field/{fieldName}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - data views
      summary: Get a runtime field
      description: "Retrieve a single runtime field by name from a data view.\n"
      operationId: getRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_field_name'
        - $ref: '#/components/parameters/Data_views_view_id'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data_view:
                    type: object
                  fields:
                    type: array
                    items:
                      type: object
              examples:
                getRuntimeFieldResponse:
                  $ref: '#/components/examples/Data_views_get_runtime_field_response'
        '404':
          description: Object is not found.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_404_response'
              examples:
                getRuntimeFieldNotFound:
                  $ref: '#/components/examples/Data_views_error_404_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field/${FIELD_NAME}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/data_views/data_view/{viewId}/runtime_field/{fieldName}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - data views
      summary: Update a runtime field
      description: "Update an existing runtime field in a data view. Only the fields provided in the request body are updated.\n"
      operationId: updateRuntimeFieldDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_field_name'
        - $ref: '#/components/parameters/Data_views_view_id'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - runtimeField
              type: object
              properties:
                runtimeField:
                  type: object
                  description: "The runtime field definition object.\n\nYou can update following fields:\n\n- `type`\n- `script`\n"
            examples:
              updateRuntimeFieldRequest:
                $ref: '#/components/examples/Data_views_update_runtime_field_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                updateRuntimeFieldBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/data_view/${DATA_VIEW_ID}/runtime_field/${FIELD_NAME}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"runtimeField\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['\"'\"'timestamp'\"'\"'].value.getHour())\"}}}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/data_view/{viewId}/runtime_field/{fieldName}\n{\"runtimeField\":{\"type\":\"long\",\"script\":{\"source\":\"emit(doc['timestamp'].value.getHour())\"}}}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/default:
    get:
      tags:
        - data views
      summary: Get the default data view
      description: "Retrieve the identifier of the default data view for the current Kibana space.\n"
      operationId: getDefaultDataViewDefault
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  data_view_id:
                    type: string
              examples:
                getDefaultDataViewResponse:
                  $ref: '#/components/examples/Data_views_get_default_data_view_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                getDefaultDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/data_views/default\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/data_views/default\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - data views
      summary: Set the default data view
      description: "Set the default data view for the current Kibana space. The default data view is used as a fallback when no specific data view is selected.\n"
      operationId: setDefaultDatailViewDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - data_view_id
              type: object
              properties:
                data_view_id:
                  type:
                    - 'null'
                    - string
                  description: "The data view identifier. NOTE: The API does not validate whether it is a valid identifier. Use `null` to unset the default data view.\n"
                force:
                  type: boolean
                  description: Update an existing default data view identifier.
                  default: false
            examples:
              setDefaultDataViewRequest:
                $ref: '#/components/examples/Data_views_set_default_data_view_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  acknowledged:
                    type: boolean
              examples:
                setDefaultDataViewResponse:
                  $ref: '#/components/examples/Data_views_set_default_data_view_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Data_views_400_response'
              examples:
                setDefaultDataViewBadRequest:
                  $ref: '#/components/examples/Data_views_error_400_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/default\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"data_view_id\":\"ff959d40-b880-11e8-a6d9-e546fe2bba5f\",\"force\":true}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/default\n{\"data_view_id\":\"ff959d40-b880-11e8-a6d9-e546fe2bba5f\",\"force\":true}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/swap_references:
    post:
      tags:
        - data views
      summary: Swap saved object references
      description: "Swap saved object references from one data view to another. Use this endpoint to update dashboards, visualizations, and other saved objects that reference a data view. WARNING: Misuse can break large numbers of saved objects! Use the [`_preview`](https://www.elastic.co/docs/api/doc/kibana/operation/operation-previewswapdataviewsdefault) endpoint to see which saved objects would be affected before making changes.\n"
      operationId: swapDataViewsDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Data_views_swap_data_view_request_object'
            examples:
              swapDataViewRequest:
                $ref: '#/components/examples/Data_views_swap_data_view_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  deleteStatus:
                    type: object
                    properties:
                      deletePerformed:
                        type: boolean
                      remainingRefs:
                        type: integer
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: A saved object identifier.
                        type:
                          type: string
                          description: The saved object type.
              examples:
                swapDataViewResponse:
                  $ref: '#/components/examples/Data_views_swap_data_view_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/swap_references\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"fromId\":\"abcd-efg\",\"toId\":\"xyz-123\",\"delete\":true}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/swap_references\n{\"fromId\":\"abcd-efg\",\"toId\":\"xyz-123\",\"delete\":true}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/data_views/swap_references/_preview:
    post:
      tags:
        - data views
      summary: Preview swap references
      description: "Preview the effect of swapping saved object references from one data view to another. Returns the list of affected saved objects without making any changes.\n"
      operationId: previewSwapDataViewsDefault
      parameters:
        - $ref: '#/components/parameters/Data_views_kbn_xsrf'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Data_views_swap_data_view_request_object'
            examples:
              previewSwapDataViewRequest:
                $ref: '#/components/examples/Data_views_preview_swap_data_view_request'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  result:
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                          description: A saved object identifier.
                        type:
                          type: string
                          description: The saved object type.
              examples:
                previewSwapDataViewResponse:
                  $ref: '#/components/examples/Data_views_preview_swap_data_view_response'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/data_views/swap_references/_preview\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"fromId\":\"abcd-efg\",\"toId\":\"xyz-123\"}'\n"
        - lang: Console
          source: "POST kbn://api/data_views/swap_references/_preview\n{\"fromId\":\"abcd-efg\",\"toId\":\"xyz-123\"}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/assignees:
    post:
      tags:
        - Security Detections API
      summary: Assign and unassign users from attack discovery alerts
      description: "Assign users to attack discovery alerts, and unassign them from alerts.\nOptionally cascade the change to related detection alerts via `kibana.alert.attack_discovery.alert_ids`.\n> info\n> You cannot add and remove the same assignee in the same request.\n"
      operationId: SetAttacksAssignees
      requestBody:
        description: An object containing assignees to add or remove and attack ids the changes will be applied to
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAttacksAssigneesByIds'
            examples:
              add:
                value:
                  assignees:
                    add:
                      - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
                    remove: [ ]
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
              remove:
                value:
                  assignees:
                    add: [ ]
                    remove:
                      - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
              withRelatedAlerts:
                value:
                  assignees:
                    add:
                      - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
                    remove: [ ]
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  update_related_alerts: true
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch update by query response
              examples:
                success:
                  value:
                    batches: 1
                    deleted: 0
                    failures: [ ]
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 76
                    total: 1
                    updated: 1
                    version_conflicts: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one attack id is required to update assignees'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/search:
    post:
      tags:
        - Security Detections API
      summary: Find and/or aggregate attack discovery alerts
      description: Find and/or aggregate attack discovery alerts that match the given query. Searches scheduled and ad hoc attack discovery alert indices for the active space only.
      operationId: SearchAttacks
      requestBody:
        description: Search and/or aggregation query
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_QueryAlertsBodyParams'
            examples:
              byIds:
                value:
                  query:
                    ids:
                      values:
                        - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch search response
              examples:
                success:
                  value:
                    _shards:
                      failed: 0
                      skipped: 0
                      successful: 1
                      total: 1
                    hits:
                      hits:
                        - _id: 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                          _index: .internal.adhoc.alerts-security.attack.discovery.alerts-default-000001
                          _score: 1
                          _source:
                            '@timestamp': '2025-06-23T15:16:52.984Z'
                            kibana.alert.attack_discovery.alert_ids:
                              - ee183cf525d7e9d0f47d1b2bb928d760a0f53756ffa61edcf0672f71c986ac21
                              - 46ebac989ca72439b14b57d32102543c17d5f33e0f6532d8a5c148949d8ff7b5
                            kibana.alert.attack_discovery.title_with_replacements: Widespread Malware Campaign via Compromised Account
                            kibana.alert.workflow_status: open
                      max_score: 1
                      total:
                        relation: eq
                        value: 1
                    timed_out: false
                    took: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Failed to parse search request: unknown query clause in bool filter'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/status:
    post:
      tags:
        - Security Detections API
      summary: Set attack discovery alerts workflow status
      description: 'Set the workflow status of one or more attack discovery alerts by IDs, optionally cascading the status to their related detection alerts.'
      operationId: SetAttacksStatus
      requestBody:
        description: An object containing the desired status and explicit attack ids
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAttacksStatusByIds'
            examples:
              byId:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: acknowledged
              closedWithReason:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  reason: false_positive
                  status: closed
              withRelatedAlerts:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: closed
                  update_related_alerts: true
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch update by query response
              examples:
                success:
                  value:
                    batches: 1
                    deleted: 0
                    failures: [ ]
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 81
                    total: 1
                    updated: 1
                    version_conflicts: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one attack id is required to update status'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/attacks/tags:
    post:
      tags:
        - Security Detections API
      summary: Add and remove attack discovery alert tags
      description: 'Add tags to attack discovery alerts, and remove them from alerts, by attack IDs in a single request. Optionally cascade tag changes to related detection alerts.'
      operationId: SetAttacksTags
      requestBody:
        description: An object containing tags to add or remove and attack ids the changes will be applied to
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAttacksTagsByIds'
            examples:
              add:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  tags:
                    tags_to_add:
                      - investigation
                    tags_to_remove: [ ]
              remove:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  tags:
                    tags_to_add: [ ]
                    tags_to_remove:
                      - investigation
              withRelatedAlerts:
                value:
                  ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  tags:
                    tags_to_add:
                      - investigation
                    tags_to_remove: [ ]
                  update_related_alerts: true
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch update by query response
              examples:
                success:
                  value:
                    batches: 1
                    deleted: 0
                    failures: [ ]
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 68
                    total: 1
                    updated: 1
                    version_conflicts: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message:
                      - 'Duplicate tags ["duplicate"] were found in the tags_to_add and tags_to_remove parameters.'
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/index:
    delete:
      tags:
        - Security Detections API
      summary: Delete an alerts index
      description: "Permanently deletes the Elastic Security alerts backing index in the current space, including the alerts\nstored in it. Use with caution; prefer lifecycle policies or the UI when available.\nCall `GET /api/detection_engine/index` first to confirm the index that will be removed.\n"
      operationId: DeleteAlertsIndex
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - acknowledged
                type: object
                properties:
                  acknowledged:
                    type: boolean
              examples:
                acknowledged:
                  value:
                    acknowledged: true
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough permissions response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                forbidden:
                  value:
                    message: 'API [DELETE /api/detection_engine/index] is unauthorized for the current user. The user needs alerts management permissions for the space.'
                    status_code: 403
        '404':
          description: Index does not exist response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: The Elastic Security alerts index to delete was not found.
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Detections API
      summary: Reads the alert index name if it exists
      description: "Returns the backing Elasticsearch index for Elastic Security detection alerts in the current space, and\nwhether its mapping is outdated. Use this to verify that an alert index is provisioned before creating\nor running rules that write alerts to it.\n"
      operationId: ReadAlertsIndex
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - name
                  - index_mapping_outdated
                type: object
                properties:
                  index_mapping_outdated:
                    type:
                      - 'null'
                      - boolean
                  name:
                    type: string
              examples:
                success:
                  value:
                    index_mapping_outdated: false
                    name: .alerts-security.alerts-default
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough permissions response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                forbidden:
                  value:
                    message: 'API [GET /api/detection_engine/index] is unauthorized for the current user. Check Security and Kibana feature privileges (detection engine / alerts) for the space.'
                    status_code: 403
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: Elastic Security alert index is not found for the current space.
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Detections API
      summary: Create an alerts index
      description: "Creates an index for Elastic Security alerts. Calling this API is not\nrequired for the detection engine to function properly. You can create\nrules and alerts without calling this API.\n"
      operationId: CreateAlertsIndex
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - acknowledged
                type: object
                properties:
                  acknowledged:
                    type: boolean
              examples:
                acknowledged:
                  value:
                    acknowledged: true
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough permissions response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                forbidden:
                  value:
                    message: 'API [POST /api/detection_engine/index] is unauthorized for the current user. The user must be able to create indices for the Elastic Security solution.'
                    status_code: 403
        '404':
          description: Not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: A prerequisite resource required to create the alerts index was not found.
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/privileges:
    get:
      tags:
        - Security Detections API
      summary: Returns user privileges for the Kibana space
      description: "Retrieves whether or not the user is authenticated, and the user's Kibana\nspace and index privileges, which determine if the user can create an\nindex for the Elastic Security alerts generated by\ndetection engine rules.\n"
      operationId: ReadPrivileges
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - is_authenticated
                  - has_encryption_key
                type: object
                properties:
                  has_encryption_key:
                    type: boolean
                  is_authenticated:
                    type: boolean
              examples:
                success:
                  value:
                    application: { }
                    cluster:
                      all: true
                      manage: true
                      manage_api_key: true
                      manage_index_templates: true
                      manage_ml: true
                      manage_own_api_key: true
                      manage_pipeline: true
                      manage_security: true
                      manage_transform: true
                      monitor: true
                      monitor_ml: true
                      monitor_transform: true
                    has_all_requested: true
                    has_encryption_key: true
                    index:
                      .alerts-security.alerts-default:
                        all: true
                        create: true
                        create_doc: true
                        create_index: true
                        delete: true
                        delete_index: true
                        index: true
                        maintenance: true
                        manage: true
                        monitor: true
                        read: true
                        view_index_metadata: true
                        write: true
                    is_authenticated: true
                    username: elastic
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules:
    delete:
      tags:
        - Security Detections API
      summary: Delete a detection rule
      description: "Delete a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `DELETE /api/detection_engine/rules?id=<id>`\n* `rule_id`- `DELETE /api/detection_engine/rules?rule_id=<rule_id>`\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n"
      operationId: DeleteRule
      parameters:
        - name: id
          in: query
          description: The rule's `id` value.
          schema:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
        - name: rule_id
          in: query
          description: The rule's `rule_id` value.
          schema:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
              examples:
                deletedRule:
                  summary: Response shape after a rule is deleted
                  value:
                    actions: [ ]
                    created_at: '2020-02-03T11:19:04.259Z'
                    created_by: elastic
                    description: Process started by MS Office program in user folder
                    enabled: false
                    false_positives: [ ]
                    from: now-4200s
                    id: c41d170b-8ba6-4de6-b8ec-76440a35ace3
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: event.action:Process*
                    references: [ ]
                    risk_score: 50
                    rule_id: process_started_by_ms_office_user_folder
                    severity: low
                    tags:
                      - tag
                    throttle: 'null'
                    to: now
                    type: query
                    updated_at: '2020-02-03T11:19:04.462Z'
                    updated_by: elastic
                    version: 3
      x-codeSamples:
        - lang: cURL
          source: "curl \\\n  --request DELETE https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n  --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Detections API
      summary: Retrieve a detection rule
      description: "Retrieve a detection rule using the `rule_id` or `id` field.\n\nThe URL query must include one of the following:\n\n* `id` - `GET /api/detection_engine/rules?id=<id>`\n* `rule_id` - `GET /api/detection_engine/rules?rule_id=<rule_id>`\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n"
      operationId: ReadRule
      parameters:
        - name: id
          in: query
          description: The rule's `id` value.
          schema:
            $ref: '#/components/schemas/Security_Detections_API_UUID'
        - name: rule_id
          in: query
          description: The rule's `rule_id` value.
          schema:
            $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      responses:
        '200':
          description: "Indicates a successful call.\n> info\n> These fields are under development and their usage or schema may change: execution_summary.\n"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
              examples:
                example1:
                  summary: Example response for a retrieved rule
                  value:
                    created_at: '2020-02-03T11:19:04.259Z'
                    created_by: elastic
                    description: Process started by MS Office program in user folder
                    enabled: false
                    execution_summary:
                      last_execution:
                        date: '2022-03-23T16:06:12.787Z'
                        message: 'This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.'
                        metrics:
                          execution_gap_duration_s: 0
                          total_indexing_duration_ms: 15
                          total_search_duration_ms: 135
                        status: partial failure
                        status_order: 20
                    false_positives: [ ]
                    filters:
                      - query:
                          match:
                            event.action:
                              query: 'Process Create (rule: ProcessCreate)'
                              type: phrase
                    from: now-4200s
                    id: c41d170b-8ba6-4de6-b8ec-76440a35ace3
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: process.name
                        type: keyword
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                    risk_score: 21
                    rule_id: process_started_by_ms_office_user_folder
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat:
                      - framework: MITRE ATT&CK
                        tactic:
                          id: TA0001
                          name: Initial Access
                          reference: https://attack.mitre.org/tactics/TA0001
                        technique:
                          - id: T1193
                            name: Spearphishing Attachment
                            reference: https://attack.mitre.org/techniques/T1193
                    to: now-300s
                    type: query
                    updated_at: '2020-02-03T11:19:04.462Z'
                    updated_by: elastic
                    version: 1
      x-codeSamples:
        - lang: cURL
          source: "curl \\\n  --request GET https://localhost:5601/api/detection_engine/rules?rule_id=bfeaf89b-a2a7-48a3-817f-e41829dc61ee \\\n  --header \"Content-Type: application/json; Elastic-Api-Version=2023-10-31\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - Security Detections API
      summary: Patch a detection rule
      description: "Update specific fields of an existing detection rule using the `rule_id` or `id` field.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n"
      operationId: PatchRule
      requestBody:
        description: "> info\n> You cannot modify the `id` or `rule_id` values.\n"
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RulePatchProps'
            examples:
              example1:
                summary: Patch query rule
                value:
                  id: 14b7b513-3d8d-4b22-b7da-a7ae632f7e76
                  name: New name
              example2:
                summary: Patch EQL rule
                value:
                  rule_id: process_started_by_ms_office_program_possible_payload
                  threat:
                    - framework: MITRE ATT&CK
                      tactic:
                        id: TA0001
                        name: Initial Access
                        reference: https://attack.mitre.org/tactics/TA0001
                      technique:
                        - id: T1193
                          name: Spearphishing Attachment
                          reference: https://attack.mitre.org/techniques/T1193
              example3:
                summary: Patch threshold rule
                value:
                  id: 005d2c4f-51ca-493d-a2bd-20ef076339b1
                  query: 'agent.version : * and agent.id : "243d9b4f-ca01-4311-8e5c-9abbee91afd8"'
                  threshold:
                    cardinality: [ ]
                    field: [ ]
                    value: 600
              example4:
                summary: Patch new terms rule
                value:
                  history_window_start: now-3d
                  id: 569aac91-40dc-4807-a8ae-a2c8698089c4
                  new_terms_fields:
                    - Endpoint.policy.applied.artifacts.global.identifiers.name
              example5:
                summary: Patch esql rule
                value:
                  id: 0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd
                  query: "FROM logs-abc*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp)\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) \n| KEEP event_rate\n"
              example6:
                summary: Patch indicator match rule
                value:
                  id: 462f1986-10fe-40a3-a22c-2b1c9c4c48fd
                  threat_query: '@timestamp >= "now-30d/d" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:"false"'
              example7:
                summary: Patch machine learning rule
                value:
                  anomaly_threshold: 50
                  id: 60b13926-289b-41b1-a537-197ef1fa5059
                  machine_learning_job_id:
                    - auth_high_count_logon_events_ea
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
              examples:
                example1:
                  summary: Example response for an updated rule
                  value:
                    actions: [ ]
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Updated description for the rule.
                    enabled: false
                    false_positives: [ ]
                    filters:
                      - query: 'null'
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: Updated Rule Name
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: [ ]
                    related_integrations:
                      - package: o365
                    required_fields:
                      - name: process.parent.name
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat: [ ]
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 2
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Detections API
      summary: Create a detection rule
      description: "Create a new detection rule.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n\nYou can create the following types of rules:\n\n* **Custom query**: Searches the defined indices and creates an alert when a document matches the rule's KQL query.\n* **Event correlation**: Searches the defined indices and creates an alert when results match an [Event Query Language (EQL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/eql.html) query.\n* **Threshold**: Searches the defined indices and creates an alert when the number of times the specified field's value meets the threshold during a single execution. When there are multiple values that meet the threshold, an alert is generated for each value.\n  For example, if the threshold `field` is `source.ip` and its `value` is `10`, an alert is generated for every source IP address that appears in at least 10 of the rule's search results. If you're interested, see [Terms Aggregation](https://www.elastic.co/guide/en/elasticsearch/reference/current/search-aggregations-bucket-terms-aggregation.html) for more information.\n* **Indicator match**: Creates an alert when fields match values defined in the specified [Elasticsearch index](https://www.elastic.co/guide/en/elasticsearch/reference/current/indices-create-index.html). For example, you can create an index for IP addresses and use this index to create an alert whenever an event's `destination.ip` equals a value in the index. The index's field mappings should be [ECS-compliant](https://www.elastic.co/guide/en/ecs/current/ecs-reference.html).\n* **New terms**: Generates an alert for each new term detected in source documents within a specified time range.\n* **ES|QL**: Uses [Elasticsearch Query Language (ES|QL)](https://www.elastic.co/guide/en/elasticsearch/reference/current/esql.html) to find events and aggregate search results.\n* **Machine learning rules**: Creates an alert when a machine learning job discovers an anomaly above the defined threshold.\n> info\n> To create machine learning rules, you must have the [appropriate license](https://www.elastic.co/subscriptions) or use a [cloud deployment](https://cloud.elastic.co/registration). Additionally, for the machine learning rule to function correctly, the associated machine learning job must be running.\n\nTo retrieve machine learning job IDs, which are required to create machine learning jobs, call the [Elasticsearch Get jobs API](https://www.elastic.co/guide/en/elasticsearch/reference/current/ml-get-job.html). Machine learning jobs that contain `siem` in the `groups` field can be used to create rules:\n\n```json\n...\n\"job_id\": \"linux_anomalous_network_activity_ecs\",\n\"job_type\": \"anomaly_detector\",\n\"job_version\": \"7.7.0\",\n\"groups\": [\n  \"auditbeat\",\n  \"process\",\n  \"siem\"\n],\n...\n```\n\nAdditionally, you can set up notifications for when rules create alerts. The notifications use the [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting). Each action type requires a connector. Connectors store the information required to send notifications via external systems. The following connector types are supported for rule notifications:\n\n* Slack\n* Email\n* PagerDuty\n* Webhook\n* Microsoft Teams\n* IBM Resilient\n* Jira\n* ServiceNow ITSM\n> info\n> For more information on PagerDuty fields, see [Send a v2 Event](https://developer.pagerduty.com/docs/events-api-v2/trigger-events/).\n\nTo retrieve connector IDs, which are required to configure rule notifications, call the [Find objects API](https://www.elastic.co/docs/api/doc/kibana/operation/operation-findsavedobjects) with `\"type\": \"action\"` in the request payload.\n\nFor detailed information on Kibana actions and alerting, and additional API calls, see:\n\n* [Alerting API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-alerting)\n* [Alerting and Actions framework](https://www.elastic.co/docs/explore-analyze/alerting)\n* [Connectors API](https://www.elastic.co/docs/api/doc/kibana/group/endpoint-connectors)\n"
      operationId: CreateRule
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RuleCreateProps'
            examples:
              example1:
                summary: Query rule
                description: Query rule that searches for processes started by MS Office
                value:
                  description: Process started by MS Office program - possible payload
                  enabled: false
                  filters:
                    - query:
                        match:
                          event.action:
                            query: 'Process Create (rule: ProcessCreate)'
                            type: phrase
                  from: now-70m
                  interval: 1h
                  language: kuery
                  name: MS Office child process
                  query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                  related_integrations:
                    - package: o365
                      version: ^2.3.2
                  required_fields:
                    - name: process.parent.name
                      type: keyword
                  risk_score: 50
                  rule_id: process_started_by_ms_office_program
                  severity: low
                  tags:
                    - child process
                    - ms office
                  type: query
              example2:
                summary: Threshold rule
                description: Threshold rule that detects multiple failed login attempts to a Windows host from the same external source IP address
                value:
                  description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.
                  enabled: true
                  exceptions_list:
                    - id: int-ips
                      namespace_type: single
                      type: detection
                  from: now-180s
                  index:
                    - winlogbeat-*
                  interval: 2m
                  name: Windows server prml-19
                  query: host.name:prml-19 and event.category:authentication and event.outcome:failure
                  required_fields:
                    - name: source.ip
                      type: ip
                  risk_score: 30
                  rule_id: liv-win-ser-logins
                  severity: low
                  severity_mapping:
                    - field: source.geo.city_name
                      operator: equals
                      severity: low
                      value: Manchester
                    - field: source.geo.city_name
                      operator: equals
                      severity: medium
                      value: London
                    - field: source.geo.city_name
                      operator: equals
                      severity: high
                      value: Birmingham
                    - field: source.geo.city_name
                      operator: equals
                      severity: critical
                      value: Wallingford
                  tags:
                    - Brute force
                  threshold:
                    field: source.ip
                    value: 20
                  type: threshold
              example3:
                summary: Machine learning rule
                description: 'Machine learning rule that creates alerts, and sends Slack notifications, when the linux_anomalous_network_activity_ecs machine learning job discovers anomalies with a threshold of 70 or above.'
                value:
                  actions:
                    - action_type_id: .slack
                      group: default
                      id: 5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5
                      params:
                        message: 'Urgent: {{context.rule.description}}'
                  anomaly_threshold: 70
                  description: Generates alerts when the job discovers anomalies over 70
                  enabled: true
                  from: now-6m
                  interval: 5m
                  machine_learning_job_id: linux_anomalous_network_activity_ecs
                  name: Anomalous Linux network activity
                  note: Shut down the internet.
                  risk_score: 70
                  rule_id: ml_linux_network_high_threshold
                  setup: This rule requires data coming in from Elastic Defend.
                  severity: high
                  tags:
                    - machine learning
                    - Linux
                  type: machine_learning
              example4:
                summary: EQL rule
                description: Event correlation rule that creates alerts when the Windows rundll32.exe process makes unusual network connections
                value:
                  description: Unusual rundll32.exe network connection
                  language: eql
                  name: rundll32.exe network connection
                  query: 'sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]'
                  required_fields:
                    - name: event.type
                      type: keyword
                    - name: process.args
                      type: keyword
                    - name: process.args_count
                      type: long
                    - name: process.entity_id
                      type: keyword
                    - name: process.name
                      type: keyword
                    - name: process.pe.original_file_name
                      type: keyword
                  risk_score: 21
                  rule_id: eql-outbound-rundll32-connections
                  severity: low
                  tags:
                    - EQL
                    - Windows
                    - rundll32.exe
                  type: eql
              example5:
                summary: Indicator match rule
                description: "Indicator match rule that creates an alert when one of the following is true: The event's destination IP address and port number matches destination IP and port values in the threat_index index; The event's source IP address matches a host IP address value in the threat_index index.\n"
                value:
                  actions: [ ]
                  description: Checks for bad IP addresses listed in the ip-threat-list index
                  index:
                    - packetbeat-*
                  name: Bad IP threat match
                  query: destination.ip:* or host.ip:*
                  required_fields:
                    - name: destination.ip
                      type: ip
                    - name: destination.port
                      type: long
                    - name: host.ip
                      type: ip
                  risk_score: 50
                  severity: medium
                  threat_index:
                    - ip-threat-list
                  threat_mapping:
                    - entries:
                        - field: destination.ip
                          type: mapping
                          value: destination.ip
                        - field: destination.port
                          type: mapping
                          value: destination.port
                    - entries:
                        - field: source.ip
                          type: mapping
                          value: host.ip
                  threat_query: '*:*'
                  type: threat_match
              example6:
                summary: New terms rule
                description: New terms rule that creates alerts a new IP address is detected for a user
                value:
                  description: Detects a user associated with a new IP address
                  history_window_start: now-30d
                  index:
                    - auditbeat*
                  language: kuery
                  name: New User IP Detected
                  new_terms_fields:
                    - user.id
                    - source.ip
                  query: '*'
                  required_fields:
                    - name: user.id
                      type: keyword
                    - name: source.ip
                      type: ip
                  risk_score: 21
                  severity: medium
                  type: new_terms
              example7:
                summary: Esql rule
                description: esql rule that creates alerts from events that match an Excel parent process
                value:
                  description: Find Excel events
                  enabled: false
                  from: now-360s
                  interval: 5m
                  language: esql
                  name: Find Excel events
                  query: 'from auditbeat-8.10.2 METADATA _id, _version, _index | where process.parent.name == "EXCEL.EXE"'
                  required_fields:
                    - name: process.parent.name
                      type: keyword
                  risk_score: 21
                  severity: low
                  tags: [ ]
                  to: now
                  type: esql
              example8:
                summary: Query rule 2
                description: Query rule that searches for processes started by MS Office and suppresses alerts by the process.parent.name field within a 5-hour time period
                value:
                  alert_suppression:
                    duration:
                      unit: h
                      value: 5
                    group_by:
                      - process.parent.name
                    missing_fields_strategy: suppress
                  description: Process started by MS Office program - possible payload
                  enabled: false
                  filters:
                    - query:
                        match:
                          event.action:
                            query: 'Process Create (rule: ProcessCreate)'
                            type: phrase
                  from: now-70m
                  interval: 1h
                  language: kuery
                  name: MS Office child process
                  query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                  risk_score: 50
                  rule_id: process_started_by_ms_office_program
                  severity: low
                  tags:
                    - child process
                    - ms office
                  type: query
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
              examples:
                example1:
                  summary: Query rule response
                  description: Example response for a query rule
                  value:
                    actions: [ ]
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Process started by MS Office program - possible payload
                    enabled: false
                    false_positives: [ ]
                    filters:
                      - query:
                          match:
                            event.action:
                              query: 'Process Create (rule: ProcessCreate)'
                              type: phrase
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: MS Office child process
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                      - integration: graphactivitylogs
                        package: azure
                        version: ^1.11.4
                    required_fields:
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat: [ ]
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 1
                example2:
                  summary: Machine learning response
                  description: Example response for a machine learning job rule
                  value:
                    actions:
                      - action_type_id: .slack
                        frequency:
                          notifyWhen: onActiveAlert
                          summary: true
                          throttle: 'null'
                        group: default
                        id: 5ad22cd5-5e6e-4c6c-a81a-54b626a4cec5
                        params:
                          message: 'Urgent: {{context.rule.description}}'
                    anomaly_threshold: 70
                    created_at: '2020-04-07T14:45:15.679Z'
                    created_by: elastic
                    description: Generates alerts when the job discovers anomalies over 70
                    enabled: true
                    false_positives: [ ]
                    from: now-6m
                    id: 83876f66-3a57-4a99-bf37-416494c80f3b
                    immutable: false
                    interval: 5m
                    machine_learning_job_id: linux_anomalous_network_activity_ecs
                    max_signals: 100
                    name: Anomalous Linux network activity
                    note: Shut down the internet.
                    references: [ ]
                    related_integrations: [ ]
                    required_fields: [ ]
                    risk_score: 70
                    rule_id: ml_linux_network_high_threshold
                    setup: ''
                    severity: high
                    status: going to run
                    status_date: '2020-04-07T14:45:21.685Z'
                    tags:
                      - machine learning
                      - Linux
                    threat: [ ]
                    to: now
                    type: machine_learning
                    updated_at: '2020-04-07T14:45:15.892Z'
                    updated_by: elastic
                    version: 1
                example3:
                  summary: Threshold rule response
                  description: Example response for a threshold rule
                  value:
                    actions: [ ]
                    author: [ ]
                    created_at: '2020-07-22T10:27:23.486Z'
                    created_by: elastic
                    description: Detects when there are 20 or more failed login attempts from the same IP address with a 2 minute time frame.
                    enabled: true
                    exceptions_list:
                      - id: int-ips
                        namespace_type: single
                        type: detection
                    false_positives: [ ]
                    from: now-180s
                    id: 15dbde26-b627-4d74-bb1f-a5e0ed9e4993
                    immutable: false
                    index:
                      - winlogbeat-*
                    interval: 2m
                    language: kuery
                    max_signals: 100
                    name: Windows server prml-19
                    query: host.name:prml-19 and event.category:authentication and event.outcome:failure
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: source.ip
                        type: ip
                    risk_score: 30
                    risk_score_mapping: [ ]
                    rule_id: liv-win-ser-logins
                    setup: ''
                    severity: low
                    severity_mapping:
                      - field: source.geo.city_name
                        operator: equals
                        severity: low
                        value: Manchester
                      - field: source.geo.city_name
                        operator: equals
                        severity: medium
                        value: London
                      - field: source.geo.city_name
                        operator: equals
                        severity: high
                        value: Birmingham
                      - field: source.geo.city_name
                        operator: equals
                        severity: critical
                        value: Wallingford
                    tags:
                      - Brute force
                    threat: [ ]
                    threshold:
                      field: source.ip
                      value: 20
                    to: now
                    type: threshold
                    updated_at: '2020-07-22T10:27:23.673Z'
                    updated_by: elastic
                    version: 1
                example4:
                  summary: EQL rule response
                  description: Example response for an EQL rule
                  value:
                    author: [ ]
                    created_at: '2020-10-05T09:06:16.392Z'
                    created_by: elastic
                    description: Unusual rundll32.exe network connection
                    enabled: true
                    exceptions_list: [ ]
                    false_positives: [ ]
                    from: now-6m
                    id: 93808cae-b05b-4dc9-8479-73574b50f8b1
                    immutable: false
                    interval: 5m
                    language: eql
                    max_signals: 100
                    name: rundll32.exe network connection
                    query: 'sequence by process.entity_id with maxspan=2h [process where event.type in ("start", "process_started") and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe") and ((process.args == "rundll32.exe" and process.args_count == 1) or (process.args != "rundll32.exe" and process.args_count == 0))] [network where event.type == "connection" and (process.name == "rundll32.exe" or process.pe.original_file_name == "rundll32.exe")]'
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: event.type
                        type: keyword
                      - ecs: true
                        name: process.args
                        type: keyword
                      - ecs: true
                        name: process.args_count
                        type: long
                      - ecs: true
                        name: process.entity_id
                        type: keyword
                      - ecs: true
                        name: process.name
                        type: keyword
                      - ecs: true
                        name: process.pe.original_file_name
                        type: keyword
                    risk_score: 21
                    risk_score_mapping: [ ]
                    rule_id: eql-outbound-rundll32-connections
                    setup: ''
                    severity: low
                    severity_mapping: [ ]
                    tags:
                      - EQL
                      - Windows
                      - rundll32.exe
                    threat: [ ]
                    throttle: no_actions
                    to: now
                    type: eql
                    updated_at: '2020-10-05T09:06:16.403Z'
                    updated_by: elastic
                    version: 1
                example5:
                  summary: Indicator match rule response
                  description: Example response for an indicator match rule
                  value:
                    author: [ ]
                    created_at: '2020-10-06T07:07:58.227Z'
                    created_by: elastic
                    description: Checks for bad IP addresses listed in the ip-threat-list index
                    enabled: true
                    exceptions_list: [ ]
                    false_positives: [ ]
                    from: now-6m
                    id: d5daa13f-81fb-4b13-be2f-31011e1d9ae1
                    immutable: false
                    index:
                      - packetbeat-*
                    interval: 5m
                    language: kuery
                    max_signals: 100
                    name: Bad IP threat match
                    query: destination.ip:* or host.ip:*
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: destination.ip
                        type: ip
                      - ecs: true
                        name: destination.port
                        type: long
                      - ecs: true
                        name: host.ip
                        type: ip
                    risk_score: 50
                    risk_score_mapping: [ ]
                    rule_id: 608501e4-c768-4f64-9326-cec55b5d439b
                    setup: ''
                    severity: medium
                    severity_mapping: [ ]
                    tags: [ ]
                    threat: [ ]
                    threat_index:
                      - ip-threat-list
                    threat_mapping:
                      - entries:
                          - field: destination.ip
                            type: mapping
                            value: destination.ip
                          - field: destination.port
                            type: mapping
                            value: destination.port
                      - entries:
                          - field: source.ip
                            type: mapping
                            value: host.ip
                    threat_query: '*:*'
                    to: now
                    type: threat_match
                    updated_at: '2020-10-06T07:07:58.237Z'
                    updated_by: elastic
                    version: 1
                example6:
                  summary: New terms rule response
                  description: Example response for a new terms rule
                  value:
                    author: [ ]
                    created_at: '2020-10-06T07:07:58.227Z'
                    created_by: elastic
                    description: Detects a user associated with a new IP address
                    enabled: true
                    exceptions_list: [ ]
                    false_positives: [ ]
                    from: now-6m
                    history_window_start: now-30d
                    id: eb7225c0-566b-11ee-8b4f-bbf3afdeb9f4
                    immutable: false
                    index:
                      - auditbeat*
                    interval: 5m
                    language: kuery
                    max_signals: 100
                    name: New User IP Detected
                    new_terms_fields:
                      - user.id
                      - source.ip
                    query: '*'
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: user.id
                        type: keyword
                      - ecs: true
                        name: source.ip
                        type: ip
                    risk_score: 21
                    risk_score_mapping: [ ]
                    rule_id: c6f5d0bc-7be9-47d4-b2f3-073d22641e30
                    setup: ''
                    severity: medium
                    severity_mapping: [ ]
                    tags: [ ]
                    threat: [ ]
                    to: now
                    type: new_terms
                    updated_at: '2020-10-06T07:07:58.237Z'
                    updated_by: elastic
                    version: 1
                example7:
                  summary: Esql rule response
                  description: Example response for an Esql rule
                  value:
                    actions: [ ]
                    author: [ ]
                    created_at: '2023-10-18T10:55:14.269Z'
                    created_by: elastic
                    description: Find Excel events
                    enabled: false
                    exceptions_list: [ ]
                    false_positives: [ ]
                    from: now-360s
                    id: d0f20490-6da4-11ee-b85e-09e9b661f2e2
                    immutable: false
                    interval: 5m
                    language: esql
                    max_signals: 100
                    name: Find Excel events
                    output_index: ''
                    query: from auditbeat-8.10.2 METADATA _id | where process.parent.name == "EXCEL.EXE"
                    references: [ ]
                    related_integrations:
                      - package: o365
                        version: ^2.3.2
                    required_fields:
                      - ecs: true
                        name: process.parent.name
                        type: keyword
                    revision: 0
                    risk_score: 21
                    risk_score_mapping: [ ]
                    rule_id: e4b53a89-debd-4a0d-a3e3-20606952e589
                    setup: ''
                    severity: low
                    severity_mapping: [ ]
                    tags: [ ]
                    threat: [ ]
                    to: now
                    type: esql
                    updated_at: '2023-10-18T10:55:14.269Z'
                    updated_by: elastic
                    version: 1
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Detections API
      summary: Update a detection rule
      description: "Update a detection rule using the `rule_id` or `id` field. The original rule is replaced, and all unspecified fields are deleted.\n\nThe difference between the `id` and `rule_id` is that the `id` is a unique rule identifier that is randomly generated when a rule is created and cannot be set, whereas `rule_id` is a stable rule identifier that can be assigned during rule creation.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n"
      operationId: UpdateRule
      requestBody:
        description: "> info\n> All unspecified fields are deleted. You cannot modify the `id` or `rule_id` values.\n"
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_RuleUpdateProps'
            examples:
              example1:
                summary: Update query rule
                value:
                  description: A new description
                  id: 14b7b513-3d8d-4b22-b7da-a7ae632f7e76
                  name: A new name for the rule
                  risk_score: 22
                  severity: medium
                  type: query
              example2:
                summary: Update EQL rule
                value:
                  description: eql rule test
                  id: 9b684efb-acf9-4323-9bff-8335b3867d14
                  index:
                    - apm-*-transaction*
                  language: eql
                  name: New name for EQL rule
                  query: process where process.name == "regsvr32.exe"
                  risk_score: 21
                  severity: low
                  type: eql
              example3:
                summary: Update threshold rule
                value:
                  description: Description of threat rule test
                  id: 005d2c4f-51ca-493d-a2bd-20ef076339b1
                  language: kuery
                  name: New name for threat rule
                  query: 'agent.version : * and agent.id : "243d9b4f-ca01-4311-8e5c-9abbee91afd8"'
                  risk_score: 21
                  severity: low
                  tags:
                    - new_tag
                  threshold:
                    cardinality: [ ]
                    field: [ ]
                    value: 400
                  type: threshold
              example4:
                summary: Update new terms rule
                value:
                  description: New description
                  history_window_start: now-7d
                  id: 569aac91-40dc-4807-a8ae-a2c8698089c4
                  interval: 5m
                  name: New terms rule name
                  new_terms_fields:
                    - Endpoint.policy.applied.artifacts.global.identifiers.name
                  query: 'agent.version : "9.1.0"'
                  risk_score: 21
                  severity: low
                  type: new_terms
              example5:
                summary: Update esql rule
                value:
                  description: New description for esql rule
                  id: 0b15e8a2-49b6-47e0-a8e6-d63a6cc335bd
                  language: esql
                  name: New name for esql rule
                  query: "FROM logs*\n| STATS count = COUNT(*), min_timestamp = MIN(@timestamp) /* MIN(dateField) finds the earliest timestamp in the dataset. */\n| EVAL event_rate = count / DATE_DIFF(\"seconds\", min_timestamp, NOW()) /* Calculates the event rate by dividing the total count of events by the time difference (in seconds) between the earliest event and the current time. */\n| KEEP event_rate\n"
                  risk_score: 21
                  severity: low
                  type: esql
              example6:
                summary: Update indicator match rule
                value:
                  description: New description
                  id: 462f1986-10fe-40a3-a22c-2b1c9c4c48fd
                  name: New name for Indicator Match rule
                  query: source.ip:* or destination.ip:*\n
                  risk_score: 99
                  severity: critical
                  threat_index:
                    - filebeat-*
                    - logs-ti_*
                  threat_mapping:
                    - entries:
                        - field: source.ip
                          type: mapping
                          value: threat.indicator.ip
                    - entries:
                        - field: destination.ip
                          type: mapping
                          value: threat.indicator.ip
                  threat_query: '@timestamp >= "now-30d/d" and event.module:(threatintel or ti_*) and threat.indicator.ip:* and not labels.is_ioc_transform_source:"true"'
                  type: threat_match
              example7:
                summary: Update machine learning rule
                value:
                  anomaly_threshold: 50
                  description: New description of ml rule
                  id: 60b13926-289b-41b1-a537-197ef1fa5059
                  machine_learning_job_id:
                    - auth_high_count_logon_events_ea
                  name: New name of ml rule
                  risk_score: 21
                  severity: low
                  type: machine_learning
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
              examples:
                example1:
                  summary: Example response for an updated rule
                  value:
                    actions: [ ]
                    created_at: '2020-04-07T14:51:09.755Z'
                    created_by: elastic
                    description: Updated description for the rule.
                    enabled: false
                    false_positives: [ ]
                    filters:
                      - query: 'null'
                    from: now-70m
                    id: 6541b99a-dee9-4f6d-a86d-dbd1869d73b1
                    immutable: false
                    interval: 1h
                    language: kuery
                    max_signals: 100
                    name: Updated Rule Name
                    query: process.parent.name:EXCEL.EXE or process.parent.name:MSPUB.EXE or process.parent.name:OUTLOOK.EXE or process.parent.name:POWERPNT.EXE or process.parent.name:VISIO.EXE or process.parent.name:WINWORD.EXE
                    references: [ ]
                    related_integrations:
                      - package: o365
                    required_fields:
                      - name: process.parent.name
                    risk_score: 50
                    rule_id: process_started_by_ms_office_program
                    setup: ''
                    severity: low
                    tags:
                      - child process
                      - ms office
                    threat: [ ]
                    to: now
                    type: query
                    updated_at: '2020-04-07T14:51:09.970Z'
                    updated_by: elastic
                    version: 2
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_bulk_action:
    post:
      tags:
        - Security Detections API
      summary: Apply a bulk action to detection rules
      description: "Apply a bulk action, such as bulk edit, duplicate, or delete, to multiple detection rules. The bulk action is applied to all rules that match the query or to the rules listed by their IDs.\n\nThe edit action allows you to add, delete, or set tags, index patterns, investigation fields, rule actions and schedules for multiple rules at once. \nThe edit action is idempotent, meaning that if you add a tag to a rule that already has that tag, no changes are made. The same is true for other edit actions, for example removing an index pattern that is not specified in a rule will not result in any changes. The only exception is the `add_rule_actions` and `set_rule_actions` action, which is non-idempotent. This means that if you add or set a rule action to a rule that already has that action, a new action is created with a new unique ID.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n"
      operationId: PerformRulesBulkAction
      parameters:
        - name: dry_run
          in: query
          description: "Enables dry run mode for the request call.\n\nEnable dry run mode to verify that bulk actions can be applied to specified rules. Certain rules, such as prebuilt Elastic rules on a Basic subscription, can’t be edited and will return errors in the request response. Error details will contain an explanation, the rule name and/or ID, and additional troubleshooting information.\n\nTo enable dry run mode on a request, add the query parameter `dry_run=true` to the end of the request URL. Rules specified in the request will be temporarily updated. These updates won’t be written to Elasticsearch.\n> info\n> Dry run mode is not supported for the `export` bulk action. A 400 error will be returned in the request response.\n"
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_BulkDeleteRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkDisableRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkEnableRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkExportRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkDuplicateRules'
                - $ref: '#/components/schemas/Security_Detections_API_BulkManualRuleRun'
                - $ref: '#/components/schemas/Security_Detections_API_BulkManualRuleFillGaps'
                - $ref: '#/components/schemas/Security_Detections_API_BulkEditRules'
            examples:
              example01:
                summary: Enable - Enable all rules with the test tag
                description: The following request activates all rules with the test tag.
                value:
                  action: enable
                  query: 'alert.attributes.tags: "test"'
              example02:
                summary: Enable - Enable a specific rule by ID.
                description: The following request enables the rule with the specified ID.
                value:
                  action: enable
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
              example03:
                summary: Disable - Disable a specific rule by ID
                description: The following request disables the rule with the specified ID.
                value:
                  action: disable
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
              example04:
                summary: Duplicate - Duplicate rules with specific IDs
                description: 'The following request duplicates rules with the specified IDs, including exceptions but not expired exceptions.'
                value:
                  action: duplicate
                  duplicate:
                    include_exceptions: true
                    include_expired_exceptions: false
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
                    - 461a4c22-416e-4009-a9a7-cf79656454bf
              example05:
                summary: Delete - Delete a specific rule by ID
                description: The following request deletes the rule with the specified ID.
                value:
                  action: delete
                  ids:
                    - cf4abfd1-7c37-4519-ab0f-5ea5c75fac60
              example06:
                summary: Run - Run a specific rule by ID
                description: The following request runs the rule with the specified ID within the given date range.
                value:
                  action: run
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
                  run:
                    end_date: '2025-03-10T23:59:59.999Z'
                    start_date: '2025-03-01T00:00:00.000Z'
              example07:
                summary: Export - Export specific rules by ID
                description: The following request exports the rules with the specified IDs.
                value:
                  action: export
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
              example08:
                summary: Edit - dry run - Validate add_index_patterns bulk action
                description: 'The following request will validate that the add_index_patterns bulk action can be successfully applied to three rules. The dry_run parameter is specified in query parameters, e.g. POST api/detection_engine/rules/_bulk_action?dry_run=true'
                value:
                  action: edit
                  edit:
                    - type: add_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
                    - de8f5af0-0831-11ed-ac8b-05a222bd8d4a
              example09:
                summary: Edit - Add a tag to rules (idempotent)
                description: 'The following request adds the tag "tag-1" to the rules with the specified IDs. If the tag already exists for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: add_tags
                      value:
                        - tag-1
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example10:
                summary: Edit - Add two tags to rules (idempotent)
                description: 'The following request adds two tags at the same time, tag-1 and tag-2, to the rules that have the IDs sent in the payload. If the tags already exist for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: add_tags
                      value:
                        - tag-1
                        - tag-2
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example11:
                summary: Edit - Delete a tag from rules (idempotent)
                description: 'The following request removes the tag "tag-1" from the rules with the specified IDs. If the tag does not exist for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: delete_tags
                      value:
                        - tag-1
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example12:
                summary: Edit - Set (overwrite existing) tags for rules (idempotent)
                description: 'The following request sets the tags "tag-1" and "tag-2" for the rules with the specified IDs, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: set_tags
                      value:
                        - tag-1
                        - tag-2
                  ids:
                    - 8bc7dad0-9320-11ec-9265-8b772383a08d
                    - 8e5c1a40-9320-11ec-9265-8b772383a08d
              example13:
                summary: Edit - Add index patterns to rules (idempotent)
                description: 'The following request adds the index pattern "test-*" to the rules with the specified IDs. If the index pattern already exists for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: add_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example14:
                summary: Edit - Remove index patterns from rules (idempotent)
                description: 'The following request removes the index pattern "test-*" from the rules with the specified IDs. If the index pattern does not exist for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: delete_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example15:
                summary: Edit - Set (overwrite existing) index patterns for rules patterns (idempotent)
                description: 'The following request sets the index patterns "test-*" and "prod-*" for the rules with the specified IDs, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: set_index_patterns
                      value:
                        - test-*
                  ids:
                    - 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                    - dc015d10-0831-11ed-ac8b-05a222bd8d4a
              example16:
                summary: Edit - Add investigation field to rules
                description: The following request adds investigation field to the rules with the specified IDs.
                value:
                  action: edit
                  edit:
                    - type: add_investigation_fields
                      value:
                        field_names:
                          - alert.status
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example17:
                summary: Edit - Delete investigation fields from rules (idempotent)
                description: 'The following request deletes investigation fields from the rules with the specified IDs. If the field does not exist for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: delete_investigation_fields
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
                  value:
                    - field1
                    - field2
              example18:
                summary: Edit - Set (overwrite existing) investigation fields for rules (idempotent)
                description: 'The following request sets investigation fields for the rules with the specified IDs, overwriting any existing investigation fields. If the set of investigation fields is the same as the existing investigation fields, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: set_investigation_fields
                      value:
                        - field1
                        - field2
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example19:
                summary: Edit - Set (overwrite existing) timeline template for rules (idempotent)
                description: 'The following request sets a timeline template for the rules with the specified IDs. If the same timeline template is already set for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: set_timeline
                      value:
                        timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                        timeline_title: Alerts Involving a Single User Timeline
                  ids:
                    - eacdfc95-e007-41c9-986e-4b2cbdfdc71b
              example20:
                summary: Edit - Set (overwrite existing) schedule for rules (idempotent)
                description: 'The following request sets a schedule for the rules with the specified IDs. If the same schedule is already set for a rule, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: set_schedule
                      value:
                        interval: 1h
                        lookback: 30m
                  ids:
                    - 99887766-5544-3322-1100-aabbccddeeff
              example21:
                summary: Edit - Add rule actions to rules (non-idempotent)
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: The message body
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191928
              example22:
                summary: Edit - Set (overwrite existing) rule actions for rules (non-idempotent)
                description: The following request sets rule actions for the rules with the specified IDs. Each action receives its own unique ID.
                value:
                  action: edit
                  edit:
                    - type: set_rule_actions
                      value:
                        actions:
                          - group: default
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: The message body
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191928
              example23:
                summary: Edit - Add rule actions to rules for a webhook connector
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              body: The message body
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example24:
                summary: Edit - Add rule actions to rules for an email connector
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              message: The message body
                              subject: Subject
                              to: address@domain.com
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example25:
                summary: Edit - Add rule actions to rules for a slack connector
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              message: The content of the message
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example26:
                summary: Edit - Add rule actions to rules for a PagerDuty connector
                description: The following request adds rule actions to the rules with the specified IDs. Each new action receives its own unique ID.
                value:
                  action: edit
                  edit:
                    - type: add_rule_actions
                      value:
                        actions:
                          - group: default3
                            id: 20fbf986-a270-460e-80f3-7b83c08b430f
                            params:
                              eventAction: trigger
                              severity: critical
                              summary: The message body
                              timestamp: '2023-10-31T00:00:00Z'
                  ids:
                    - 9e946bfc-3118-4c77-bb25-67d781191921
              example27:
                summary: Edit - Set alert suppression to rules (idempotent)
                description: The following request set alert suppression to the rules with the specified IDs.
                value:
                  action: edit
                  edit:
                    - type: set_alert_suppression
                      value:
                        duration:
                          unit: h
                          value: 1
                        group_by:
                          - source.ip
                        missing_fields_strategy: suppress
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example28:
                summary: Edit - Set alert suppression to threshold rules (idempotent)
                description: The following request set alert suppression to threshold rules with the specified IDs.
                value:
                  action: edit
                  edit:
                    - type: set_alert_suppression_for_threshold
                      value:
                        duration:
                          unit: h
                          value: 1
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example29:
                summary: Edit - Removes alert suppression from rules (idempotent)
                description: 'The following request removes alert suppression from the rules with the specified IDs. If the rules do not have alert suppression, no changes are made.'
                value:
                  action: edit
                  edit:
                    - type: delete_alert_suppression
                  ids:
                    - 12345678-1234-1234-1234-1234567890ab
                    - 87654321-4321-4321-4321-0987654321ba
              example30:
                summary: Fill Gaps - Manually trigger the filling of gaps for specified rules
                description: The following request triggers the filling of gaps for the specified rule ids and time range
                value:
                  action: fill_gaps
                  ids:
                    - 748694f0-6977-4ea5-8384-cd2e39730779
                    - 164d0918-f720-4c9f-9f5c-c5122587cf19
                  run:
                    end_date: '2025-03-10T23:59:59.999Z'
                    start_date: '2025-03-01T00:00:00.000Z'
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_BulkEditActionResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_BulkExportActionResponse'
              examples:
                example01:
                  summary: Successful response
                  description: 'In this response one rule was updated and one was skipped. Objects returned in attributes.results.skipped will only include rules'' id, name, and skip_reason.'
                  value:
                    attributes:
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped:
                          - id: 51658332-a15e-4c9e-912a-67214e2e2359
                            name: Skipped rule
                            skip_reason: RULE_NOT_MODIFIED
                        updated:
                          - anomaly_threshold: 50
                            author:
                              - Elastic
                            created_at: '2022-02-21T14:14:13.801Z'
                            created_by: elastic
                            description: 'A machine learning job detected unusually large numbers of DNS queries for a single top-level DNS domain, which is often used for DNS tunneling. DNS tunneling can be used for command-and-control, persistence, or data exfiltration activity. For example, dnscat tends to generate many DNS questions for a top-level domain as it uses the DNS protocol to tunnel data.'
                            enabled: true
                            exceptions_list: [ ]
                            execution_summary:
                              last_execution:
                                date: '2022-03-23T16:06:12.787Z'
                                message: 'This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.'
                                metrics:
                                  execution_gap_duration_s: 0
                                  total_indexing_duration_ms: 15
                                  total_search_duration_ms: 135
                                status: partial failure
                                status_order: 20
                            false_positives:
                              - 'DNS domains that use large numbers of child domains, such as software or content distribution networks, can trigger this alert and such parent domains can be excluded.'
                            from: now-45m
                            id: 8bc7dad0-9320-11ec-9265-8b772383a08d
                            immutable: false
                            interval: 15m
                            license: Elastic License v2
                            machine_learning_job_id:
                              - dns_tunneling_ea
                            max_signals: 100
                            name: 'DNS Tunneling [Duplicate]'
                            references:
                              - https://www.elastic.co/docs/reference/machine-learning/ootb-ml-jobs-siem
                            related_integrations: [ ]
                            required_fields: [ ]
                            risk_score: 21
                            risk_score_mapping: [ ]
                            rule_id: 7289bf08-4e91-4c70-bf01-e04c4c5d7756
                            setup: ''
                            severity: low
                            severity_mapping: [ ]
                            tags:
                              - Elastic
                              - Network
                              - Threat Detection
                              - ML
                            threat: [ ]
                            to: now
                            type: machine_learning
                            updated_at: '2022-02-21T17:05:50.883Z'
                            updated_by: elastic
                            version: 6
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 1
                        total: 2
                    rules_count: 1
                    success: true
                example02:
                  summary: Partial failure
                  description: 'If processing of any rule fails, a partial error outputs the ID and/or name of the affected rule and the corresponding error, as well as successfully processed rules (in the same format as a successful 200 request).'
                  value:
                    value:
                      attributes:
                        errors:
                          - message: Index patterns can't be added. Machine learning rule doesn't have index patterns property
                            rules:
                              - id: 8bc7dad0-9320-11ec-9265-8b772383a08d
                                name: 'DNS Tunneling [Duplicate]'
                            status_code: 500
                        results:
                          created: [ ]
                          deleted: [ ]
                          skipped: [ ]
                          updated:
                            - actions: [ ]
                              author:
                                - Elastic
                              created_at: '2022-02-21T14:14:17.883Z'
                              created_by: elastic
                              description: Generates a detection alert for each external alert written to the configured indices. Enabling this rule allows you to immediately begin investigating external alerts in the app.
                              enabled: true
                              exceptions_list: [ ]
                              execution_summary:
                                last_execution:
                                  date: '2022-03-23T16:06:12.787Z'
                                  message: 'This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.'
                                  metrics:
                                    execution_gap_duration_s: 0
                                    total_indexing_duration_ms: 15
                                    total_search_duration_ms: 135
                                  status: partial failure
                                  status_order: 20
                              false_positives: [ ]
                              from: now-6m
                              id: 8e5c1a40-9320-11ec-9265-8b772383a08d
                              immutable: false
                              index:
                                - apm-*-transaction*
                                - traces-apm*
                                - auditbeat-*
                                - filebeat-*
                                - logs-*
                                - packetbeat-*
                                - winlogbeat-*
                                - added-by-id-*
                              interval: 5m
                              language: kuery
                              license: Elastic License v2
                              max_signals: 10000
                              name: 'External Alerts [Duplicate]'
                              query: "event.kind:alert and not event.module:(endgame or endpoint)\n"
                              references: [ ]
                              related_integrations: [ ]
                              required_fields: [ ]
                              risk_score: 47
                              risk_score_mapping:
                                - field: event.risk_score
                                  operator: equals
                                  value: ''
                              rule_id: 941faf98-0cdc-4569-b16d-4af962914d61
                              rule_name_override: message
                              setup: ''
                              severity: medium
                              severity_mapping:
                                - field: event.severity
                                  operator: equals
                                  severity: low
                                  value: '21'
                                - field: event.severity
                                  operator: equals
                                  severity: medium
                                  value: '47'
                                - field: event.severity
                                  operator: equals
                                  severity: high
                                  value: '73'
                                - field: event.severity
                                  operator: equals
                                  severity: critical
                                  value: '99'
                              tags:
                                - Elastic
                                - Network
                                - Windows
                                - APM
                                - macOS
                                - Linux
                              threat: [ ]
                              timestamp_override: event.ingested
                              to: now
                              type: query
                              updated_at: '2022-02-21T16:56:22.818Z'
                              updated_by: elastic
                              version: 5
                        summary:
                          failed: 1
                          skipped: 0
                          succeeded: 1
                          total: 2
                      message: Bulk edit partially failed
                      rules_count: 2
                      status_code: 500
                      success: false
                example03:
                  summary: Dry run
                  description: 'The attributes.errors section of the response shows that two rules failed to update and one succeeded. The same results would be returned if you ran the request without dry run mode enabled. Notice that there are no arrays in attributes.results. In dry run mode, rule updates are not applied and saved to Elasticsearch, so the endpoint wouldn’t return results for rules that have been updated, created, or deleted.'
                  value:
                    attributes:
                      errors:
                        - err_code: IMMUTABLE
                          message: Elastic rule can't be edited
                          rules:
                            - id: 81aa0480-06af-11ed-94fb-dd1a0597d8d2
                              name: Unusual AWS Command for a User
                          status_code: 500
                        - err_code: MACHINE_LEARNING_INDEX_PATTERN
                          message: Machine learning rule doesn't have index patterns
                          rules:
                            - id: dc015d10-0831-11ed-ac8b-05a222bd8d4a
                              name: 'Suspicious Powershell Script [Duplicate]'
                          status_code: 500
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped: [ ]
                        updated: [ ]
                      summary:
                        failed: 2
                        skipped: 0
                        succeeded: 1
                        total: 3
                    message: Bulk edit partially failed
                    status_code: 500
                example04:
                  summary: Set tags successsully for 2 rules
                  description: 'This example presents the successful setting of tags for 2 rules. There was a difference between the set of tags that were being added and the tags that were already set in the rules, that''s why the rules were updated.'
                  value:
                    attributes:
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped: [ ]
                        updated:
                          - actions: [ ]
                            author: [ ]
                            created_at: '2025-03-25T11:46:41.899Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: [ ]
                            false_positives: [ ]
                            filters: [ ]
                            from: now-6m
                            id: 738112cd-6cfa-414a-8457-2a658845d6ba
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - '-*elastic-cloud-logs-*'
                            interval: 5m
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Rule 1
                            output_index: ''
                            query: '*'
                            references: [ ]
                            related_integrations: [ ]
                            required_fields: [ ]
                            revision: 1
                            risk_score: 21
                            risk_score_mapping: [ ]
                            rule_id: 6fb746a0-dfe5-40fa-b03f-5cbb84f3e32e
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: [ ]
                            tags:
                              - tag-1
                              - tag-2
                            threat: [ ]
                            to: now
                            type: query
                            updated_at: '2025-03-25T11:47:11.350Z'
                            updated_by: elastic
                            version: 2
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: 'null'
                                group: default
                                id: 20fbf986-a270-460e-80f3-7b83c08b430f
                                params:
                                  body: Hello
                                uuid: 580e2e16-5e91-411c-999b-7b75a11ed441
                            author: [ ]
                            created_at: '2025-03-25T09:49:08.343Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: [ ]
                            false_positives: [ ]
                            filters: [ ]
                            from: now-360s
                            id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - '-*elastic-cloud-logs-*'
                            interval: 3m
                            investigation_fields:
                              field_names:
                                - alert.status
                                - Endpoint.policy.applied.artifacts.global.channel
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              from: 3m
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Rule 2
                            output_index: ''
                            query: '*'
                            references: [ ]
                            related_integrations: [ ]
                            required_fields: [ ]
                            revision: 33
                            risk_score: 21
                            risk_score_mapping: [ ]
                            rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: [ ]
                            tags:
                              - tag-1
                              - tag-2
                            threat: [ ]
                            timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                            timeline_title: Alerts Involving a Single User Timeline
                            to: now
                            type: query
                            updated_at: '2025-03-25T11:47:11.357Z'
                            updated_by: elastic
                            version: 24
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 2
                        total: 2
                    rules_count: 2
                    success: true
                example05:
                  summary: Idempotent behavior of set_tags
                  description: 'This example presents the idempotent behavior of the edit action with set_tags request. Both rules already had exactly the same tags that were being added, so no changes were made in any of them.'
                  value:
                    attributes:
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped:
                          - id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            name: Rule 1
                            skip_reason: RULE_NOT_MODIFIED
                          - id: 738112cd-6cfa-414a-8457-2a658845d6ba
                            name: Rule 2
                            skip_reason: RULE_NOT_MODIFIED
                        updated: [ ]
                      summary:
                        failed: 0
                        skipped: 2
                        succeeded: 0
                        total: 2
                    rules_count: 2
                    success: true
                example06:
                  summary: Idempotent behavior of add_tags
                  description: This example presents the idempotent behavior of the edit action with add_tags request. One rule was updated and one was skipped. The rule that was skipped already had all the tags that were being added.
                  value:
                    attributes:
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped:
                          - id: 738112cd-6cfa-414a-8457-2a658845d6ba
                            name: Test Rule 2
                            skip_reason: RULE_NOT_MODIFIED
                        updated:
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: 'null'
                                group: default
                                id: 20fbf986-a270-460e-80f3-7b83c08b430f
                                params:
                                  body: Hello
                                uuid: 580e2e16-5e91-411c-999b-7b75a11ed441
                            author: [ ]
                            created_at: '2025-03-25T09:49:08.343Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: [ ]
                            false_positives: [ ]
                            filters: [ ]
                            from: now-360s
                            id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - '-*elastic-cloud-logs-*'
                            interval: 3m
                            investigation_fields:
                              field_names:
                                - alert.status
                                - Endpoint.policy.applied.artifacts.global.channel
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              from: 3m
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Test rule
                            output_index: ''
                            query: '*'
                            references: [ ]
                            related_integrations: [ ]
                            required_fields: [ ]
                            revision: 34
                            risk_score: 21
                            risk_score_mapping: [ ]
                            rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: [ ]
                            tags:
                              - tag-1
                              - tag-2
                              - tag-4
                            threat: [ ]
                            timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                            timeline_title: Alerts Involving a Single User Timeline
                            to: now
                            type: query
                            updated_at: '2025-03-25T11:55:12.752Z'
                            updated_by: elastic
                            version: 25
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 1
                        total: 2
                    rules_count: 2
                    success: true
                example07:
                  summary: Non-idempotent behavior for set_rule_actions
                  description: 'This example shows a non-idempotent nature of the set_rule_actions requests. Regardless if the actions are the same as the existing actions for a rule, the actions are always set in the rule and receive a new unique ID.'
                  value:
                    attributes:
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped: [ ]
                        updated:
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: 'null'
                                group: default
                                id: 20fbf986-a270-460e-80f3-7b83c08b430f
                                params:
                                  body: Hello
                                uuid: e48428e5-efac-4856-b8ad-b271c14eaa91
                            author: [ ]
                            created_at: '2025-03-25T09:49:08.343Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: [ ]
                            false_positives: [ ]
                            filters: [ ]
                            from: now-360s
                            id: eacdfc95-e007-41c9-986e-4b2cbdfdc71b
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - '-*elastic-cloud-logs-*'
                            interval: 3m
                            investigation_fields:
                              field_names:
                                - alert.status
                                - Endpoint.policy.applied.artifacts.global.channel
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              from: 3m
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Test rule
                            output_index: ''
                            query: '*'
                            references: [ ]
                            related_integrations: [ ]
                            required_fields: [ ]
                            revision: 39
                            risk_score: 21
                            risk_score_mapping: [ ]
                            rule_id: 43250a55-53a3-4ddd-96cb-82a1bd720180
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: [ ]
                            tags:
                              - tag-1
                              - tag-2
                              - tag-4
                            threat: [ ]
                            timeline_id: 3e827bab-838a-469f-bd1e-5e19a2bff2fd
                            timeline_title: Alerts Involving a Single User Timeline
                            to: now
                            type: query
                            updated_at: '2025-03-25T12:17:40.528Z'
                            updated_by: elastic
                            version: 30
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 1
                        total: 1
                    rules_count: 1
                    success: true
                example08:
                  summary: Non-idempotent behavior for add_rule_actions
                  description: 'This example shows a non-idempotent nature of the add_rule_actions requests. Regardless if the added action is the same as another existing action for a rule, the new action is added to the rule and receives a new unique ID.'
                  value:
                    attributes:
                      results:
                        created: [ ]
                        deleted: [ ]
                        skipped: [ ]
                        updated:
                          - actions:
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: 'null'
                                group: default
                                id: 76af173d-38d8-4a9a-b2cc-a3c695b845b4
                                params:
                                  body: Message body
                                uuid: 0309347e-3954-429c-9168-5da2663389af
                              - action_type_id: .webhook
                                frequency:
                                  notifyWhen: onActiveAlert
                                  summary: true
                                  throttle: 'null'
                                group: default
                                id: 76af173d-38d8-4a9a-b2cc-a3c695b845b4
                                params:
                                  body: Message body
                                uuid: 49ddaa94-d63d-410e-90dc-8c1bad9552bd
                            author: [ ]
                            created_at: '2025-04-02T12:42:03.400Z'
                            created_by: elastic
                            description: test
                            enabled: false
                            exceptions_list: [ ]
                            false_positives: [ ]
                            filters: [ ]
                            from: now-6m
                            id: 0d3eb0cd-88c4-4651-ac87-6d9f0cb87217
                            immutable: false
                            index:
                              - apm-*-transaction*
                              - auditbeat-*
                              - endgame-*
                              - filebeat-*
                              - logs-*
                              - packetbeat-*
                              - traces-apm*
                              - winlogbeat-*
                              - '-*elastic-cloud-logs-*'
                            interval: 5m
                            language: kuery
                            license: ''
                            max_signals: 100
                            meta:
                              kibana_siem_app_url: http://localhost:5601/kbn/app/security
                            name: Jacek test rule
                            output_index: ''
                            query: '*'
                            references: [ ]
                            related_integrations: [ ]
                            required_fields: [ ]
                            revision: 2
                            risk_score: 21
                            risk_score_mapping: [ ]
                            rule_id: 2684c020-1370-4719-ac27-eafe6428fe10
                            rule_source:
                              type: internal
                            setup: ''
                            severity: low
                            severity_mapping: [ ]
                            tags: [ ]
                            threat: [ ]
                            to: now
                            type: query
                            updated_at: '2025-04-02T12:51:40.215Z'
                            updated_by: elastic
                            version: 2
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 1
                        total: 1
                    rules_count: 1
                    success: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_export:
    post:
      tags:
        - Security Detections API
      summary: Export detection rules
      description: "Export detection rules to an `.ndjson` file. The following configuration items are also included in the `.ndjson` file:\n- Actions\n- Exception lists\n> info\n> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.\n\n> You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.\n\n> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.\n"
      operationId: ExportRules
      parameters:
        - name: exclude_export_details
          in: query
          description: Determines whether a summary of the exported rules is returned.
          schema:
            type: boolean
            default: false
        - name: file_name
          in: query
          description: "File name for saving the exported rules.\n> info\n> When using cURL to export rules to a file, use the -O and -J options to save the rules to the file name specified in the URL.\n"
          schema:
            type: string
            default: export.ndjson
      requestBody:
        content:
          application/json:
            schema:
              required:
                - objects
              type:
                - 'null'
                - object
              properties:
                objects:
                  type: array
                  items:
                    required:
                      - rule_id
                    type: object
                    properties:
                      rule_id:
                        $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
                  description: Array of objects with a rule's `rule_id` field. Do not use rule's `id` here. Exports all rules when unspecified.
            examples:
              exportByRuleIds:
                summary: Request body to export a subset of rules
                value:
                  objects:
                    - rule_id: 343580b5-c811-447c-8d2d-2ccf052c6900
                    - rule_id: 2938c9fa-53eb-4c04-b79c-33cbf041b18d
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/ndjson:
              schema:
                type: string
                description: "An `.ndjson` file containing the returned rules.\n\nEach line in the file represents an object (a rule, exception list parent container, or exception list item), and the last line includes a summary of what was exported.\n"
                format: binary
              examples:
                sampleNdjson:
                  value: "{\"rule_id\":\"343580b5-c811-447c-8d2d-2ccf052c6900\",\"name\":\"Example rule\",\"type\":\"query\",\"enabled\":true}\n{\"exception_list\":true}\n{\"export_summary\":{\"total_rules\":1,\"exceptions_count\":0}}\n"
      x-codeSamples:
        - lang: cURL
          source: "curl -X POST \"localhost:5601/api/detection_engine/rules/_export?exclude_export_details=true&file_name=exported_rules.ndjson\" -H 'kbn-xsrf: true' -H 'Content-Type: application/json' -d'\n{\n  \"objects\": [\n    {\n      \"rule_id\":\"343580b5-c811-447c-8d2d-2ccf052c6900\"\n    },\n    {\n      \"rule_id\":\"2938c9fa-53eb-4c04-b79c-33cbf041b18d\"\n    }\n  ]\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_find:
    get:
      tags:
        - Security Detections API
      summary: List all detection rules
      description: 'Retrieve a paginated list of detection rules. By default, the first page is returned, with 20 results per page.'
      operationId: FindRules
      parameters:
        - name: fields
          in: query
          description: "List of `alert.attributes` field names to return for each rule (for example `name`, `enabled`).\nIf omitted, the default field set is returned. Repeat the parameter to pass multiple field names, or\nuse comma-separated values when supported by your client.\n"
          schema:
            type: array
            items:
              type: string
        - name: filter
          in: query
          description: "Search query\n\nFilters the returned results according to the value of the specified field, using the alert.attributes.<field name>:<field value> syntax, where <field name> can be:\n- name\n- enabled\n- tags\n- createdBy\n- interval\n- updatedBy\n> info\n> Even though the JSON rule object uses created_by and updated_by fields, you must use createdBy and updatedBy fields in the filter.\n"
          schema:
            type: string
        - name: sort_field
          in: query
          description: Field to sort by
          schema:
            $ref: '#/components/schemas/Security_Detections_API_FindRulesSortField'
        - name: sort_order
          in: query
          description: Sort order
          schema:
            $ref: '#/components/schemas/Security_Detections_API_SortOrder'
        - name: page
          in: query
          description: Page number
          schema:
            minimum: 1
            type: integer
            default: 1
        - name: per_page
          in: query
          description: Rules per page
          schema:
            minimum: 0
            type: integer
            default: 20
        - name: gaps_range_start
          in: query
          description: Gaps range start
          schema:
            type: string
        - name: gaps_range_end
          in: query
          description: Gaps range end
          schema:
            type: string
        - name: gap_fill_statuses
          in: query
          description: Gap fill statuses
          schema:
            type: array
            items:
              $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
        - name: gap_auto_fill_scheduler_id
          in: query
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
          schema:
            type: string
      responses:
        '200':
          description: "Successful response\n> info\n> These fields are under development and their usage or schema may change: execution_summary.\n"
          content:
            application/json:
              schema:
                required:
                  - page
                  - perPage
                  - total
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
                  warnings:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_WarningSchema'
              examples:
                example1:
                  value:
                    data:
                      - created_at: '2020-02-02T10:05:19.613Z'
                        created_by: elastic
                        description: 'Identifies a PowerShell process launched by either cscript.exe or wscript.exe. Observing Windows scripting processes executing a PowerShell script, may be indicative of malicious activity.'
                        enabled: false
                        execution_summary:
                          last_execution:
                            date: '2022-03-23T16:06:12.787Z'
                            message: 'This rule attempted to query data from Elasticsearch indices listed in the "Index pattern" section of the rule definition, but no matching index was found.'
                            metrics:
                              execution_gap_duration_s: 0
                              total_indexing_duration_ms: 15
                              total_search_duration_ms: 135
                            status: partial failure
                            status_order: 20
                        false_positives: [ ]
                        from: now-6m
                        id: 89761517-fdb0-4223-b67b-7621acc48f9e
                        immutable: true
                        index:
                          - winlogbeat-*
                        interval: 5m
                        language: kuery
                        max_signals: 33
                        name: Windows Script Executing PowerShell
                        query: 'event.action:"Process Create (rule: ProcessCreate)" and process.parent.name:("wscript.exe" or "cscript.exe") and process.name:"powershell.exe"'
                        references: [ ]
                        related_integrations:
                          - package: o365
                            version: ^2.3.2
                        required_fields:
                          - ecs: true
                            name: event.action
                            type: keyword
                          - ecs: true
                            name: process.name
                            type: keyword
                          - ecs: true
                            name: process.parent.name
                            type: keyword
                        risk_score: 21
                        rule_id: f545ff26-3c94-4fd0-bd33-3c7f95a3a0fc
                        setup: ''
                        severity: low
                        tags:
                          - Elastic
                          - Windows
                        threat:
                          - framework: MITRE ATT&CK
                            tactic:
                              id: TA0002
                              name: Execution
                              reference: https://attack.mitre.org/tactics/TA0002/
                            technique:
                              - id: T1193
                                name: Spearphishing Attachment
                                reference: https://attack.mitre.org/techniques/T1193/
                        to: now
                        type: query
                        updated_at: '2020-02-02T10:05:19.830Z'
                        updated_by: elastic
                    page: 1
                    perPage: 5
                    total: 4
      x-codeSamples:
        - lang: cURL
          source: "curl -X GET \"localhost:5601/api/detection_engine/rules/_find?page=1&per_page=5&sort_field=enabled&sort_order=asc&filter=alert.attributes.name:windows\" -H 'kbn-xsrf: true'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/_import:
    post:
      tags:
        - Security Detections API
      summary: Import detection rules
      description: "Import detection rules from an `.ndjson` file, including actions and exception lists. The request must include:\n- The `Content-Type: multipart/form-data` HTTP header.\n- A link to the `.ndjson` file containing the rules.\n> warn\n> When used with [API key](https://www.elastic.co/docs/deploy-manage/api-keys) authentication, the user's key gets assigned to the affected rules. If the user's key gets deleted or the user becomes inactive, the rules will stop running.\n\n> If the API key that is used for authorization has different privileges than the key that created or most recently updated the rule, the rule behavior might change.\n> info\n> To import rules with actions, you need at least Read privileges for the Action and Connectors feature. To overwrite or add new connectors, you need All privileges for the Actions and Connectors feature. To import rules without actions, you don’t need Actions and Connectors privileges. Refer to [Enable and access detections](https://www.elastic.co/docs/solutions/security/detect-and-alert/detections-privileges) for more information.\n\n> info\n> Rule actions and connectors are included in the exported file, but sensitive information about the connector (such as authentication credentials) is not included. You must re-add missing connector details after importing detection rules.\n\n> You can use Kibana’s [Saved Objects](https://www.elastic.co/docs/explore-analyze/find-and-organize/saved-objects) UI (Stack Management → Kibana → Saved Objects) or the Saved Objects APIs (experimental) to [export](../operation/operation-post-saved-objects-export) and [import](../operation/operation-post-saved-objects-import) any necessary connectors before importing detection rules.\n\n> Similarly, any value lists used for rule exceptions are not included in rule exports or imports. Use the [Manage value lists](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-manage-value-lists) UI (Rules → Detection rules (SIEM) → Manage value lists) to export and import value lists separately.\n"
      operationId: ImportRules
      parameters:
        - name: overwrite
          in: query
          description: Determines whether existing rules with the same `rule_id` are overwritten.
          schema:
            type: boolean
            default: false
        - name: overwrite_exceptions
          in: query
          description: Determines whether existing exception lists with the same `list_id` are overwritten. Both the exception list container and its items are overwritten.
          schema:
            type: boolean
            default: false
        - name: overwrite_action_connectors
          in: query
          description: Determines whether existing actions with the same `kibana.alert.rule.actions.id` are overwritten.
          schema:
            type: boolean
            default: false
        - name: as_new_list
          in: query
          description: Generates a new list ID for each imported exception list.
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  description: The `.ndjson` file containing the rules.
                  format: binary
            examples:
              rulesFile:
                summary: Multipart part containing a rule export
                value:
                  file: rules_import.ndjson
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - exceptions_success
                  - exceptions_success_count
                  - exceptions_errors
                  - rules_count
                  - success
                  - success_count
                  - errors
                  - action_connectors_errors
                  - action_connectors_warnings
                  - action_connectors_success
                  - action_connectors_success_count
                type: object
                properties:
                  action_connectors_errors:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                  action_connectors_success:
                    type: boolean
                  action_connectors_success_count:
                    minimum: 0
                    type: integer
                  action_connectors_warnings:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_WarningSchema'
                  errors:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                  exceptions_errors:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_ErrorSchema'
                  exceptions_success:
                    type: boolean
                  exceptions_success_count:
                    minimum: 0
                    type: integer
                  rules_count:
                    minimum: 0
                    type: integer
                  success:
                    type: boolean
                  success_count:
                    minimum: 0
                    type: integer
                additionalProperties: false
              examples:
                example1:
                  summary: Import rules with success
                  value:
                    errors: [ ]
                    exceptions_errors: [ ]
                    exceptions_success: true
                    exceptions_success_count: 0
                    rules_count: 1
                    success: true
                    success_count: 1
      x-codeSamples:
        - lang: cURL
          source: "curl -X POST \"<KibanaURL>/api/detection_engine/rules/_import\"\n-u <username>:<password> -H 'kbn-xsrf: true'\n-H 'Content-Type: multipart/form-data'\n--form \"file=@<link to file>\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/detection_engine/rules/{id}/exceptions':
    post:
      tags:
        - Security Exceptions API
      summary: Create rule exception items
      description: Create exception items that apply to a single detection rule.
      operationId: CreateRuleExceptionListItems
      parameters:
        - name: id
          in: path
          description: Detection rule's identifier
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_UUID'
          examples:
            id:
              value: 330bdd28-eedf-40e1-bed0-f10176c7f9e0
      requestBody:
        description: Rule exception items.
        content:
          application/json:
            schema:
              required:
                - items
              type: object
              properties:
                items:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemProps'
              example:
                items:
                  - description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    type: simple
            examples:
              addItems:
                value:
                  items:
                    - description: This is a sample detection type exception item.
                      entries:
                        - field: actingProcess.file.signer
                          operator: excluded
                          type: exists
                        - field: host.name
                          operator: included
                          type: match_any
                          value:
                            - saturn
                            - jupiter
                      item_id: simple_list_item
                      list_id: simple_list
                      name: Sample Exception List Item
                      namespace_type: single
                      os_types:
                        - linux
                      tags:
                        - malware
                      type: simple
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
              examples:
                ruleExceptionItems:
                  value:
                    - _version: WzQsMV0=
                      comments: [ ]
                      created_at: '2025-01-07T20:07:33.119Z'
                      created_by: elastic
                      description: This is a sample detection type exception item.
                      entries:
                        - field: actingProcess.file.signer
                          operator: excluded
                          type: exists
                        - field: host.name
                          operator: included
                          type: match_any
                          value:
                            - saturn
                            - jupiter
                      id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                      item_id: simple_list_item
                      list_id: simple_list
                      name: Sample Exception List Item
                      namespace_type: single
                      os_types:
                        - linux
                      tags:
                        - malware
                      tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                      type: simple
                      updated_at: '2025-01-07T20:07:33.119Z'
                      updated_by: elastic
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badPayload:
                  value:
                    error: Bad Request
                    message: Invalid request payload JSON format
                    statusCode: 400
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request params]: id: Invalid uuid'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    message: Unable to create exception-list
                    status_code: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/prepackaged:
    put:
      tags:
        - Security Detections API
      summary: Install prebuilt detection rules and Timelines
      description: "Install and update all Elastic prebuilt detection rules and Timelines.\n\nThis endpoint allows you to install and update prebuilt detection rules and Timelines provided by Elastic. \nWhen you call this endpoint, it will:\n- Install any new prebuilt detection rules that are not currently installed in your system.\n- Update any existing prebuilt detection rules that have been modified or improved by Elastic.\n- Install any new prebuilt Timelines that are not currently installed in your system.\n- Update any existing prebuilt Timelines that have been modified or improved by Elastic.\n\nThis ensures that your detection engine is always up-to-date with the latest rules and Timelines, \nproviding you with the most current and effective threat detection capabilities.\n"
      operationId: InstallPrebuiltRulesAndTimelines
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                required:
                  - rules_installed
                  - rules_updated
                  - timelines_installed
                  - timelines_updated
                type: object
                properties:
                  rules_installed:
                    minimum: 0
                    type: integer
                    description: The number of rules installed
                  rules_updated:
                    minimum: 0
                    type: integer
                    description: The number of rules updated
                  timelines_installed:
                    minimum: 0
                    type: integer
                    description: The number of timelines installed
                  timelines_updated:
                    minimum: 0
                    type: integer
                    description: The number of timelines updated
                additionalProperties: false
              examples:
                example1:
                  value:
                    rules_installed: 112
                    rules_updated: 0
                    timelines_installed: 5
                    timelines_updated: 2
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/prepackaged/_status:
    get:
      tags:
        - Security Detections API
      summary: Retrieve the status of prebuilt detection rules and Timelines
      description: "Retrieve the status of all Elastic prebuilt detection rules and Timelines. \n\nThis endpoint provides detailed information about the number of custom rules, installed prebuilt rules, available prebuilt rules that are not installed, outdated prebuilt rules, installed prebuilt timelines, available prebuilt timelines that are not installed, and outdated prebuilt timelines.\n"
      operationId: ReadPrebuiltRulesAndTimelinesStatus
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                required:
                  - rules_custom_installed
                  - rules_installed
                  - rules_not_installed
                  - rules_not_updated
                  - timelines_installed
                  - timelines_not_installed
                  - timelines_not_updated
                type: object
                properties:
                  rules_custom_installed:
                    minimum: 0
                    type: integer
                    description: The total number of custom rules
                  rules_installed:
                    minimum: 0
                    type: integer
                    description: The total number of installed prebuilt rules
                  rules_not_installed:
                    minimum: 0
                    type: integer
                    description: The total number of available prebuilt rules that are not installed
                  rules_not_updated:
                    minimum: 0
                    type: integer
                    description: The total number of outdated prebuilt rules
                  timelines_installed:
                    minimum: 0
                    type: integer
                    description: The total number of installed prebuilt timelines
                  timelines_not_installed:
                    minimum: 0
                    type: integer
                    description: The total number of available prebuilt timelines that are not installed
                  timelines_not_updated:
                    minimum: 0
                    type: integer
                    description: The total number of outdated prebuilt timelines
                additionalProperties: false
              examples:
                example1:
                  value:
                    rules_custom_installed: 0
                    rules_installed: 0
                    rules_not_installed: 112
                    rules_not_updated: 0
                    timelines_installed: 0
                    timelines_not_installed: 0
                    timelines_not_updated: 0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/rules/preview:
    post:
      tags:
        - Security Detections API
      summary: Preview rule alerts generated on specified time range
      description: "Simulates a detection rule using the same rule type and query logic as a persisted rule, over a short\ntime window, without persisting a rule or writing alerts. Use the response to validate queries, see sample\nmatching documents, and inspect execution logs. Pair `invocationCount` and `timeframeEnd` to cap run time.\n"
      operationId: RulePreview
      parameters:
        - name: enable_logged_requests
          in: query
          description: 'Enables logging and returning in response ES queries, performed during rule execution'
          schema:
            type: boolean
      requestBody:
        description: "Rule create payload (same shape as `POST /api/detection_engine/rules` for a given `type`) plus\n`invocationCount` and `timeframeEnd` to control how the preview is executed. Optional\n`enable_logged_requests` surfaces Elasticsearch request logging for debugging.\n"
        content:
          application/json:
            schema:
              anyOf:
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
                - allOf:
                    - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
                    - $ref: '#/components/schemas/Security_Detections_API_RulePreviewParams'
              discriminator:
                propertyName: type
            examples:
              queryRule:
                value:
                  description: Find matching events
                  from: now-24h
                  index:
                    - logs-*
                  invocationCount: 1
                  language: kuery
                  max_signals: 20
                  name: Rule preview
                  query: 'process.name : *'
                  risk_score: 25
                  severity: low
                  timeframeEnd: '2025-01-20T12:00:00.000Z'
                  to: now
                  type: query
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - logs
                type: object
                properties:
                  isAborted:
                    type: boolean
                  logs:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_RulePreviewLogs'
                  previewId:
                    $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
              examples:
                success:
                  value:
                    isAborted: false
                    logs:
                      - duration: 45
                        errors: [ ]
                        requests: [ ]
                        startedAt: '2025-01-20T10:00:00.000Z'
                        warnings: [ ]
                    previewId: 7f1c9d1e-4c8a-4a3e-9a5d-0d4f6e1b2a90
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].timeframeEnd: expected string, received null'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/assignees:
    post:
      tags:
        - Security Detections API
      summary: Assign and unassign users from detection alerts
      description: "Assign users to detection alerts, and unassign them from alerts.\n> info\n> You cannot add and remove the same assignee in the same request.\n"
      operationId: SetAlertAssignees
      requestBody:
        description: User profile IDs to add or remove on each listed alert document ID.
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAlertAssigneesBody'
            examples:
              add:
                $ref: '#/components/examples/Security_Detections_API_SetAlertAssigneesBodyAdd'
              remove:
                $ref: '#/components/examples/Security_Detections_API_SetAlertAssigneesBodyRemove'
        required: true
      responses:
        '200':
          description: "Indicates a successful call. The body matches an Elasticsearch update-by-query response\n(for example `took`, `updated`, `failures`).\n"
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch update by query response
              examples:
                add:
                  value:
                    batches: 1
                    deleted: 0
                    failures: [ ]
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 76
                    total: 1
                    updated: 1
                    version_conflicts: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].ids: at least one alert id is required to update assignees'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/detection_engine/signals/assignees] is unauthorized for the current user, this action is granted by the Kibana Security Solution privileges for cases and detections'
                    statusCode: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/finalize_migration:
    post:
      tags:
        - Security Detections API
      summary: Finalize detection alert migrations
      description: "**DEPRECATED.** Completes a legacy alert index migration. Do not automate against this in new code.\n**WARNING:** Finalizing swaps read aliases; confirm the migration has finished successfully before calling.\n\nFinalize successful migrations of detection alerts. This replaces the original index's alias with the\nsuccessfully migrated index's alias. The endpoint is idempotent, so you can poll until a migration\nfinishes and then call this operation once.\n"
      operationId: FinalizeAlertsMigration
      requestBody:
        description: Array of `migration_id`s to finalize
        content:
          application/json:
            schema:
              required:
                - migration_ids
              type: object
              properties:
                migration_ids:
                  minItems: 1
                  type: array
                  items:
                    type: string
                  description: Array of `migration_id`s to finalize.
              example:
                migration_ids:
                  - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
            examples:
              oneMigration:
                value:
                  migration_ids:
                    - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Security_Detections_API_MigrationFinalizationResult'
              examples:
                success:
                  value:
                    migrations:
                      - completed: true
                        destinationIndex: .siem-signals-default-000002-r000016
                        id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                        sourceIndex: .siem-signals-default-000002
                        status: success
                        updated: '2021-01-06T22:05:56.859Z'
                        version: 16
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].migration_ids: at least one migration id is required to finalize'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/migration:
    delete:
      tags:
        - Security Detections API
      summary: Clean up detection alert migrations
      description: "**DEPRECATED.** Cleanup API for old migration artifacts. Do not add new call sites.\n**WARNING:** This schedules deletions; ensure no production reads still point at the source index.\n\nMigrations favor data integrity over shard size. Consequently, unused or orphaned indices are artifacts of\nthe migration process. A successful migration can leave both the old and new indices present, so the old\nindex may be deleted. While you can delete these indices manually, the endpoint applies a deletion policy\nto the relevant index, causing it to be deleted after 30 days, and removes other migration-specific artifacts.\n"
      operationId: AlertsMigrationCleanup
      requestBody:
        description: Array of `migration_id`s to cleanup
        content:
          application/json:
            schema:
              required:
                - migration_ids
              type: object
              properties:
                migration_ids:
                  minItems: 1
                  type: array
                  items:
                    type: string
                  description: Array of `migration_id`s to cleanup.
              example:
                migration_ids:
                  - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
            examples:
              cleanupMigrations:
                value:
                  migration_ids:
                    - 924f7c50-505f-11eb-ae0a-3fa2e626a51d
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Security_Detections_API_MigrationCleanupResult'
              examples:
                success:
                  value:
                    migrations:
                      - destinationIndex: .siem-signals-default-000002-r000016
                        id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                        sourceIndex: .siem-signals-default-000002
                        status: success
                        updated: '2021-01-06T22:05:56.859Z'
                        version: 16
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].migration_ids: at least one migration id is required to run cleanup'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Detections API
      summary: Initiate a detection alert migration
      description: "**DEPRECATED.** Legacy API for on-demand reindexing of old `.siem-signals-*` alert indices. Do not build new\nintegrations; upgrade the Elastic Stack and rely on product-managed data lifecycle instead.\n**WARNING:** Migrations can be resource intensive and should be planned during a maintenance window.\n\nInitiate a migration of detection alerts. Migrations are initiated per index. The process is not destructive\nand should not remove existing data, but it can consume significant cluster resources. Plan capacity accordingly.\n"
      operationId: CreateAlertsMigration
      requestBody:
        description: Alerts migration parameters
        content:
          application/json:
            schema:
              allOf:
                - required:
                    - index
                  type: object
                  properties:
                    index:
                      minItems: 1
                      type: array
                      items:
                        minLength: 1
                        type: string
                        format: nonempty
                      description: Array of index names to migrate.
                - $ref: '#/components/schemas/Security_Detections_API_AlertsReindexOptions'
            examples:
              singleIndex:
                value:
                  index:
                    - .siem-signals-default-000001
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - indices
                type: object
                properties:
                  indices:
                    type: array
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/Security_Detections_API_AlertsIndexMigrationSuccess'
                        - $ref: '#/components/schemas/Security_Detections_API_AlertsIndexMigrationError'
                        - $ref: '#/components/schemas/Security_Detections_API_SkippedAlertsIndexMigration'
              examples:
                success:
                  value:
                    indices:
                      - index: '.siem-signals-default-000001,'
                        migration_id: 923f7c50-505f-11eb-ae0a-3fa2e626a51d
                        migration_index: .siem-signals-default-000001-r000016
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].index: at least one index name is required to start a migration'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/migration_status:
    get:
      tags:
        - Security Detections API
      summary: Retrieve the status of detection alert migrations
      description: "**DEPRECATED.** This endpoint was used for historical `.siem-signals-*` index migration workflows. Do not use\nfor new automations; there is no supported replacement in this public API.\n**WARNING:** Prefer upgrading through supported Elastic stack upgrades rather than ad-hoc index migrations.\n\nRetrieves indices that contain detection alerts of a particular age, along with migration information for\neach of those indices.\n"
      operationId: ReadAlertsMigrationStatus
      parameters:
        - name: from
          in: query
          description: Maximum age of qualifying detection alerts
          required: true
          schema:
            type: string
            description: "Time from which data is analyzed. For example, now-4200s means the rule analyzes data from 70 minutes\nbefore its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).\n"
            format: date-math
            example: now-30d
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - indices
                type: object
                properties:
                  indices:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Detections_API_IndexMigrationStatus'
              examples:
                success:
                  value:
                    indices:
                      - index: .siem-signals-default-000002
                        is_outdated: true
                        migrations:
                          - id: 924f7c50-505f-11eb-ae0a-3fa2e626a51d
                            status: pending
                            updated: '2021-01-06T20:41:37.173Z'
                            version: 16
                        signal_versions:
                          - count: 100
                            version: 15
                          - count: 87
                            version: 16
                        version: 15
                      - index: .siem-signals-default-000003
                        is_outdated: false
                        migrations: [ ]
                        signal_versions:
                          - count: 54
                            version: 16
                        version: 16
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query].from: expected date-math, received null'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/search:
    post:
      tags:
        - Security Detections API
      summary: Find and/or aggregate detection alerts
      description: Find and/or aggregate detection alerts that match the given query.
      operationId: SearchAlerts
      requestBody:
        description: Search and/or aggregation query
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_QueryAlertsBodyParams'
            examples:
              query:
                value:
                  aggs:
                    alertsByGrouping:
                      terms:
                        field: host.name
                        size: 10
                    missingFields:
                      missing:
                        field: host.name
                  query:
                    bool:
                      filter:
                        - bool:
                            filter:
                              - match_phrase:
                                  kibana.alert.workflow_status: open
                            must: [ ]
                            must_not:
                              - exists:
                                  field: kibana.alert.building_block_type
                            should: [ ]
                        - range:
                            '@timestamp':
                              gte: '2025-01-17T08:00:00.000Z'
                              lte: '2025-01-18T07:59:59.999Z'
                  runtime_mappings: { }
                  size: 0
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch search response
              examples:
                success:
                  value:
                    _shards:
                      failed: 0
                      skipped: 0
                      successful: 1
                      total: 1
                    aggregations:
                      alertsByGrouping:
                        buckets:
                          - doc_count: 5
                            key: Host-f43kkddfyc
                        doc_count_error_upper_bound: 0
                        sum_other_doc_count: 0
                      missingFields:
                        doc_count: 0
                    hits:
                      hits: [ ]
                      max_score: 'null'
                      total:
                        relation: eq
                        value: 5
                    timed_out: false
                    took: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Failed to parse search request: unknown query clause in bool filter'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/status:
    post:
      tags:
        - Security Detections API
      summary: Set a detection alert status
      description: Set the status of one or more detection alerts.
      operationId: SetAlertsStatus
      requestBody:
        description: An object containing desired status and explicit alert ids or a query to select alerts
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByIds'
                - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByQuery'
            examples:
              byId:
                value:
                  signal_ids:
                    - 80e1383f856e67c1b7f7a1634744fa6d66b6e2ef7aa26d226e57afb5a7b2b4a1
                  status: closed
              byQuery:
                value:
                  conflicts: proceed
                  query:
                    bool:
                      filter:
                        - '@timestamp':
                            format: strict_date_optional_time
                            gte: '2024-10-23T07:00:00.000Z'
                            lte: '2025-01-21T20:12:11.704Z'
                          range: 'null'
                        - bool:
                            filter:
                              bool:
                                filter:
                                  - match_phrase:
                                      kibana.alert.workflow_status: open
                                  - '@timestamp':
                                      format: strict_date_optional_time
                                      gte: '2024-10-23T07:00:00.000Z'
                                      lte: '2025-01-21T20:12:11.704Z'
                                    range: 'null'
                                must: [ ]
                                must_not:
                                  - exists:
                                      field: kibana.alert.building_block_type
                                should: [ ]
                      must: [ ]
                      must_not: [ ]
                      should: [ ]
                  status: closed
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch update by query response
              examples:
                byId:
                  value:
                    batches: 1
                    deleted: 0
                    failures: [ ]
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 81
                    total: 1
                    updated: 1
                    version_conflicts: 0
                byQuery:
                  value:
                    batches: 1
                    deleted: 0
                    failures: [ ]
                    noops: 0
                    requests_per_second: -1
                    retries:
                      bulk: 0
                      search: 0
                    throttled_millis: 0
                    throttled_until_millis: 0
                    timed_out: false
                    took: 100
                    total: 17
                    updated: 17
                    version_conflicts: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].signal_ids: at least one alert id is required to update status'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/signals/tags:
    post:
      tags:
        - Security Detections API
      summary: Add and remove detection alert tags
      description: "Add tags to detection alerts, and remove them from alerts, by alert IDs or a query, in a single request.\n> info\n> You cannot add and remove the same alert tag in the same request.\n"
      operationId: SetAlertTags
      requestBody:
        description: An object containing tags to add or remove and alert ids the changes will be applied
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Detections_API_SetAlertTagsBody'
            examples:
              add:
                $ref: '#/components/examples/Security_Detections_API_SetAlertTagsBodyAdd'
              remove:
                $ref: '#/components/examples/Security_Detections_API_SetAlertTagsBodyRemove'
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                description: Elasticsearch update by query response
              examples:
                success:
                  value:
                    batches: '1,'
                    deleted: '0,'
                    failures: [ ]
                    noops: '0,'
                    requests_per_second: '-1,'
                    retries:
                      bulk: '0,'
                      search: 0
                    throttled_millis: '0,'
                    throttled_until_millis: '0,'
                    timed_out: 'false,'
                    took: '68,'
                    total: '1,'
                    updated: '1,'
                    version_conflicts: '0,'
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body].tags: cannot add and remove the same tag in a single request'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/detection_engine/tags:
    get:
      tags:
        - Security Detections API
      summary: List all detection rule tags
      description: List all unique tags from all detection rules.
      operationId: ReadTags
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
              examples:
                example1:
                  value:
                    - zeek
                    - suricata
                    - windows
                    - linux
                    - network
                    - initial access
                    - remote access
                    - phishing
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/encrypted_saved_objects/_rotate_key:
    post:
      tags:
        - saved objects
      summary: Rotate a key for encrypted saved objects
      description: "Superuser role required.\n\nIf a saved object cannot be decrypted using the primary encryption key, then Kibana will attempt to decrypt it using the specified decryption-only keys. In most of the cases this overhead is negligible, but if you're dealing with a large number of saved objects and experiencing performance issues, you may want to rotate the encryption key.\n\nThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
      operationId: rotateEncryptionKey
      parameters:
        - name: batch_size
          in: query
          description: "Specifies a maximum number of saved objects that Kibana can process in a single batch. Bulk key rotation is an iterative process since Kibana may not be able to fetch and process all required saved objects in one go and splits processing into consequent batches. By default, the batch size is 10000, which is also a maximum allowed value.\n"
          schema:
            type: number
            default: 10000
        - name: type
          in: query
          description: "Limits encryption key rotation only to the saved objects with the specified type. By default, Kibana tries to rotate the encryption key for all saved object types that may contain encrypted attributes.\n"
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
                properties:
                  failed:
                    type: number
                    description: "Indicates the number of the saved objects that were still encrypted with one of the old encryption keys that Kibana failed to re-encrypt with the primary key.\n"
                  successful:
                    type: number
                    description: "Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.\n\nNOTE: In most cases, `total` will be greater than `successful` even if `failed` is zero. The reason is that Kibana may not need or may not be able to rotate encryption keys for all encrypted saved objects.\n"
                  total:
                    type: number
                    description: "Indicates the total number of all encrypted saved objects (optionally filtered by the requested `type`), regardless of the key Kibana used for encryption.\n"
              examples:
                rotateEncryptionKeyResponse:
                  $ref: '#/components/examples/Saved_objects_key_rotation_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Saved_objects_400_response'
        '429':
          description: Already in progress.
          content:
            application/json:
              schema:
                type: object
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint_list:
    post:
      tags:
        - Security Endpoint Exceptions API
      summary: Create an Elastic Endpoint rule exception list
      description: 'Create the exception list for Elastic Endpoint rule exceptions. When you create the exception list, it will have a `list_id` of `endpoint_list`. If the Elastic Endpoint exception list already exists, your request will return an empty response.'
      operationId: CreateEndpointList
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_EndpointList'
              examples:
                alreadyExists:
                  summary: Endpoint exception list already exists (empty response)
                  value: { }
                newList:
                  summary: Endpoint exception list created
                  value:
                    created_at: '2025-01-01T00:00:00.000Z'
                    created_by: elastic
                    description: Endpoint Security Exception List
                    id: 2e23a8c4-ef7e-4c10-adfa-3eae4e4b4b8b
                    immutable: false
                    list_id: endpoint_list
                    name: Endpoint Security Exception List
                    namespace_type: agnostic
                    os_types: [ ]
                    tags: [ ]
                    tie_breaker_id: e3c5a8e0-5b6a-4b4b-8b3a-2e23a8c4ef7e
                    type: endpoint
                    updated_at: '2025-01-01T00:00:00.000Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: expected value of type [object] but got [undefined]'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Insufficient privileges
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/endpoint_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint_list/items:
    delete:
      tags:
        - Security Endpoint Exceptions API
      summary: Delete an Elastic Endpoint exception list item
      description: 'Delete an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.'
      operationId: DeleteEndpointListItem
      parameters:
        - name: id
          in: query
          description: Either `id` or `item_id` must be specified
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
        - name: item_id
          in: query
          description: Either `id` or `item_id` must be specified
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
              examples:
                deleted:
                  summary: Deleted endpoint exception list item
                  value:
                    comments: [ ]
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Blocks a known malicious file by its hash
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file
                    namespace_type: agnostic
                    os_types:
                      - windows
                    tags: [ ]
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-01T12:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: Either "item_id" or "id" needs to be defined in the request
                    statusCode: 400
        '401':
          description: Unsuccessful authentication
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Insufficient privileges
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [DELETE /api/endpoint_list/items?item_id=block-malicious-file] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Endpoint list item not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: "block-malicious-file" does not exist'
                    status_code: 404
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Endpoint Exceptions API
      summary: Get an Elastic Endpoint rule exception list item
      description: 'Get the details of an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.'
      operationId: ReadEndpointListItem
      parameters:
        - name: id
          in: query
          description: Either `id` or `item_id` must be specified
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
        - name: item_id
          in: query
          description: Either `id` or `item_id` must be specified
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
              examples:
                item:
                  summary: Endpoint exception list item
                  value:
                    comments: [ ]
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Blocks a known malicious file by its hash
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file
                    namespace_type: agnostic
                    os_types:
                      - windows
                    tags:
                      - policy:all
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-01T12:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: id or item_id required
                    statusCode: 400
        '401':
          description: Unsuccessful authentication
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Insufficient privileges
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/endpoint_list/items?item_id=block-malicious-file] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: Endpoint list item not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: "block-malicious-file" does not exist'
                    status_code: 404
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Endpoint Exceptions API
      summary: Create an Elastic Endpoint rule exception list item
      description: 'Create an Elastic Endpoint exception list item, and associate it with the Elastic Endpoint exception list.'
      operationId: CreateEndpointListItem
      requestBody:
        description: Exception list item's properties
        content:
          application/json:
            schema:
              required:
                - type
                - name
                - description
                - entries
              type: object
              properties:
                comments:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray'
                description:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription'
                entries:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray'
                item_id:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta'
                name:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemName'
                os_types:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray'
                tags:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags'
                type:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType'
            examples:
              matchAny:
                summary: Exclude multiple process names
                value:
                  description: Exclude common security tools from endpoint protection
                  entries:
                    - field: process.name
                      operator: included
                      type: match_any
                      value:
                        - scanner.exe
                        - updater.exe
                  name: Trusted security tools
                  os_types:
                    - windows
                  type: simple
              simpleMatch:
                summary: Block a specific file hash
                value:
                  description: Blocks a known malicious file by its hash
                  entries:
                    - field: file.hash.sha256
                      operator: included
                      type: match
                      value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                  name: Block malicious file
                  os_types:
                    - windows
                  tags:
                    - policy:all
                  type: simple
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
              examples:
                created:
                  summary: Endpoint exception list item created
                  value:
                    comments: [ ]
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Blocks a known malicious file by its hash
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file
                    namespace_type: agnostic
                    os_types:
                      - windows
                    tags:
                      - policy:all
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-01T12:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Required'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Insufficient privileges
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/endpoint_list/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '409':
          description: Endpoint list item already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'exception list item id: "block-malicious-file" already exists'
                    status_code: 409
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Endpoint Exceptions API
      summary: Update an Elastic Endpoint rule exception list item
      description: 'Update an Elastic Endpoint exception list item, specified by the `id` or `item_id` field.'
      operationId: UpdateEndpointListItem
      requestBody:
        description: Exception list item's properties
        content:
          application/json:
            schema:
              required:
                - type
                - name
                - description
                - entries
              type: object
              properties:
                _version:
                  type: string
                  description: 'The version id, normally returned by the API when the item is retrieved. Use it ensure updates are made against the latest version.'
                comments:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray'
                description:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription'
                entries:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray'
                id:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
                item_id:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta'
                name:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemName'
                os_types:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray'
                tags:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags'
                type:
                  $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType'
            examples:
              updateName:
                summary: Update an endpoint exception list item
                value:
                  description: Updated description for the exception
                  entries:
                    - field: file.hash.sha256
                      operator: included
                      type: match
                      value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                  item_id: block-malicious-file
                  name: Block malicious file (updated)
                  os_types:
                    - windows
                    - linux
                  type: simple
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
              examples:
                updated:
                  summary: Endpoint exception list item updated
                  value:
                    comments: [ ]
                    created_at: '2025-01-01T12:00:00.000Z'
                    created_by: elastic
                    description: Updated description for the exception
                    entries:
                      - field: file.hash.sha256
                        operator: included
                        type: match
                        value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                    id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                    item_id: block-malicious-file
                    list_id: endpoint_list
                    name: Block malicious file (updated)
                    namespace_type: agnostic
                    os_types:
                      - windows
                      - linux
                    tags:
                      - policy:all
                    tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                    type: simple
                    updated_at: '2025-01-15T09:30:00.000Z'
                    updated_by: elastic
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Required'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Insufficient privileges
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PUT /api/endpoint_list/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Endpoint list item not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list item item_id: "block-malicious-file" not found'
                    status_code: 404
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint_list/items/_find:
    get:
      tags:
        - Security Endpoint Exceptions API
      summary: Get Elastic Endpoint exception list items
      description: Get a list of all Elastic Endpoint exception list items.
      operationId: FindEndpointListItems
      parameters:
        - name: filter
          in: query
          description: "Filters the returned results according to the value of the specified field,\nusing the `<field name>:<field value>` syntax.\n"
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        - name: page
          in: query
          description: The page number to return
          schema:
            minimum: 0
            type: integer
        - name: per_page
          in: query
          description: The number of exception list items to return per page
          schema:
            minimum: 0
            type: integer
        - name: sort_field
          in: query
          description: Determines which field is used to sort the results
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        - name: sort_order
          in: query
          description: 'Determines the sort order, which can be `desc` or `asc`'
          schema:
            enum:
              - desc
              - asc
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - data
                  - page
                  - per_page
                  - total
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
                    description: The list of endpoint exception list items.
                  page:
                    minimum: 0
                    type: integer
                    description: The current page number.
                  per_page:
                    minimum: 0
                    type: integer
                    description: The number of items per page.
                  pit:
                    type: string
                    description: The point-in-time ID for pagination.
                  total:
                    minimum: 0
                    type: integer
                    description: The total number of endpoint exception list items.
              examples:
                foundItems:
                  summary: Found endpoint exception list items
                  value:
                    data:
                      - comments: [ ]
                        created_at: '2025-01-01T12:00:00.000Z'
                        created_by: elastic
                        description: Blocks a known malicious file by its hash
                        entries:
                          - field: file.hash.sha256
                            operator: included
                            type: match
                            value: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
                        id: d4b0c1e2-3f4a-5b6c-7d8e-9f0a1b2c3d4e
                        item_id: block-malicious-file
                        list_id: endpoint_list
                        name: Block malicious file
                        namespace_type: agnostic
                        os_types:
                          - windows
                        tags:
                          - policy:all
                        tie_breaker_id: f1e2d3c4-b5a6-7890-abcd-ef1234567890
                        type: simple
                        updated_at: '2025-01-01T12:00:00.000Z'
                        updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Invalid input data
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: page: Expected number, received string'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Insufficient privileges
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/endpoint_list/items/_find] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: Endpoint list not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list id: "endpoint_list" does not exist'
                    status_code: 404
        '500':
          description: Internal server error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action:
    get:
      tags:
        - Security Endpoint Management API
      summary: Get response actions
      description: Get a list of all response actions.
      operationId: EndpointGetActionsList
      parameters:
        - name: page
          in: query
          description: The page number to return.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
        - name: pageSize
          in: query
          description: The number of response actions to return per page.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
        - name: commands
          in: query
          description: A list of response action command names to filter by.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Commands'
        - name: agentIds
          in: query
          description: A list of Elastic Agent IDs to filter the response actions by.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
        - name: userIds
          in: query
          description: A list of user IDs that submitted the response actions.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_UserIds'
        - name: startDate
          in: query
          description: 'A start date in ISO 8601 format or Date Math format (for example, `now-24h`).'
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_StartDate'
        - name: endDate
          in: query
          description: 'An end date in ISO 8601 format or Date Math format (for example, `now`).'
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndDate'
        - name: agentTypes
          in: query
          description: The agent type to filter response actions by. Defaults to `endpoint`.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        - name: withOutputs
          in: query
          description: A list of response action IDs whose outputs should be included in the response.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_WithOutputs'
        - name: types
          in: query
          description: 'A list of response action types to filter by (`automated`, `manual`).'
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Types'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_GetEndpointActionListResponse'
              examples:
                actionsList:
                  summary: A list of response actions
                  value:
                    data:
                      - agents:
                          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                        agentType: endpoint
                        command: running-processes
                        completedAt: '2022-08-08T09:50:47.672Z'
                        createdBy: elastic
                        id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
                        isCompleted: true
                        isExpired: false
                        startedAt: '2022-08-08T15:24:57.402Z'
                        wasSuccessful: true
                      - agents:
                          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                        agentType: endpoint
                        command: isolate
                        completedAt: '2022-08-08T10:41:57.352Z'
                        createdBy: elastic
                        id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
                        isCompleted: true
                        isExpired: false
                        startedAt: '2022-08-08T15:23:37.359Z'
                        wasSuccessful: true
                    elasticAgentIds:
                      - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                    endDate: now
                    page: 1
                    pageSize: 10
                    startDate: now-24h/h
                    total: 2
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action_status:
    get:
      tags:
        - Security Endpoint Management API
      summary: Get response actions status
      description: Get the status of response actions for the specified agent IDs.
      operationId: EndpointGetActionsStatus
      parameters:
        - name: agent_ids
          in: query
          description: A list of agent IDs to get the action status for.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentIds'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStatusSuccessResponse'
              examples:
                actionStatus:
                  summary: Pending response actions per agent
                  value:
                    data:
                      - agent_id: afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
                        pending_actions:
                          execute: 0
                          get-file: 0
                          isolate: 0
                          kill-process: 1
                          running-processes: 0
                          scan: 0
                          unisolate: 0
                          upload: 0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/action/{action_id}':
    get:
      tags:
        - Security Endpoint Management API
      summary: Get action details
      description: Get the details of a response action using the action ID.
      operationId: EndpointGetActionsDetails
      parameters:
        - name: action_id
          in: path
          description: The ID of the response action to retrieve.
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
            example: fr518850-681a-4y60-aa98-e22640cae2b8
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionDetailsResponse'
              examples:
                actionDetails:
                  summary: Details of an isolate response action
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentType: endpoint
                      command: isolate
                      completedAt: '2022-08-08T10:41:57.352Z'
                      createdBy: elastic
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: true
                      isExpired: false
                      startedAt: '2022-08-08T15:23:37.359Z'
                      wasSuccessful: true
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/action/{action_id}/file/{file_id}':
    get:
      tags:
        - Security Endpoint Management API
      summary: Get file information
      description: "Get information for the specified response action file download.\n"
      operationId: EndpointFileInfo
      parameters:
        - name: action_id
          in: path
          description: The ID of the response action that generated the file.
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - name: file_id
          in: path
          description: "The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n"
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                properties:
                  data:
                    type: object
                    properties:
                      actionId:
                        type: string
                        description: The response action ID.
                      agentId:
                        type: string
                        description: The agent ID that generated the file.
                      agentType:
                        type: string
                        description: The type of agent that generated the file.
                      created:
                        type: string
                        description: The date and time the file was created.
                        format: date-time
                      id:
                        type: string
                        description: The unique file identifier.
                      mimeType:
                        type: string
                        description: The MIME type of the file.
                      name:
                        type: string
                        description: The file name.
                      size:
                        type: number
                        description: The file size in bytes.
                      status:
                        enum:
                          - AWAITING_UPLOAD
                          - UPLOADING
                          - READY
                          - UPLOAD_ERROR
                          - DELETED
                        type: string
                        description: The file upload status.
              examples:
                fileInfo:
                  summary: File information for a response action upload
                  value:
                    data:
                      actionId: 233db9ea-6733-4849-9226-5a7039c7161d
                      agentId: ed518850-681a-4d60-bb98-e22640cae2a8
                      agentType: endpoint
                      created: '2025-02-26T13:37:30.452Z'
                      id: 233db9ea-6733-4849-9226-5a7039c7161d.ed518850-681a-4d60-bb98-e22640cae2a8
                      mimeType: application/zip
                      name: memory_dump.zip
                      size: 1048576
                      status: READY
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/action/{action_id}/file/{file_id}/download':
    get:
      tags:
        - Security Endpoint Management API
      summary: Download a file
      description: "Download a file associated with a response action. Files are downloaded in a password-protected `.zip` archive to prevent the file from running. Use password `elastic` to open the `.zip` in a safe environment.\n> info\n> Files retrieved from third-party-protected hosts require a different password. Refer to [Third-party response actions](https://www.elastic.co/docs/solutions/security/endpoint-response-actions/third-party-response-actions) for your system's password.\n"
      operationId: EndpointFileDownload
      parameters:
        - name: action_id
          in: path
          description: The ID of the response action that generated the file.
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
        - name: file_id
          in: path
          description: "The file identifier is constructed in one of two ways:\n- For Elastic Defend agents (`agentType` of `endpoint`): combine the `action_id` and `agent_id` values using a dot (`.`) separator:\n`{file_id}` = `{action_id}.{agent_id}`\n- For all other agent types: the `file_id` is the `agent_id` for which the response action was sent to.\n"
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
              examples:
                fileDownload:
                  summary: Password-protected ZIP archive containing the response action file
                  value: binary file content (password-protected .zip)
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/cancel:
    post:
      tags:
        - Security Endpoint Management API
      summary: Cancel a response action
      description: Cancel a running or pending response action (Applies only to some agent types).
      operationId: CancelAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CancelRouteRequestBody'
            examples:
              ElasticDefend:
                summary: Cancel a response action on an Elastic Defend host
                value:
                  agent_type: endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    force: true
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
              MicrosoftDefenderEndpoint:
                summary: Cancel a response action on a Microsoft Defender for Endpoint host
                value:
                  agent_type: microsoft_defender_endpoint
                  comment: Cancelling action due to change in requirements
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                CancelSuccess:
                  summary: Cancel action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: microsoft_defender_endpoint
                      command: cancel
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        id: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/execute:
    post:
      tags:
        - Security Endpoint Management API
      summary: Run a command
      description: Run a shell command on an endpoint.
      operationId: EndpointExecuteAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ExecuteRouteRequestBody'
            examples:
              executeCommand:
                summary: Execute a shell command on an endpoint
                value:
                  comment: Get list of all files
                  endpoint_ids:
                    - b3d6de74-36b0-4fa8-be46-c375bf1771bf
                  parameters:
                    command: ls -al
                    timeout: 600
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                ExecuteSuccess:
                  summary: Execute action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: execute
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 9f934028-2300-4927-b531-b26376793dc4
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        command: ls -al
                        timeout: 600
                      startedAt: '2023-07-28T18:43:27.362Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/get_file:
    post:
      tags:
        - Security Endpoint Management API
      summary: Get a file
      description: Get a file from an endpoint.
      operationId: EndpointGetFileAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFileRouteRequestBody'
            examples:
              getFile:
                summary: Get a specific file from an endpoint
                value:
                  comment: Get my file
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                GetFileSuccess:
                  summary: Get file action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: get-file
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/isolate:
    post:
      tags:
        - Security Endpoint Management API
      summary: Isolate an endpoint
      description: Isolate an endpoint from the network. The endpoint remains isolated until it's released.
      operationId: EndpointIsolateAction
      requestBody:
        content:
          application/json:
            schema:
              required:
                - endpoint_ids
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  maxItems: 50
                  minItems: 1
                  type: array
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
                  example:
                    - alert-id-1
                    - alert-id-2
                case_ids:
                  maxItems: 50
                  minItems: 1
                  type: array
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                    - case-id-1
                    - case-id-2
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
            examples:
              multiple_endpoints:
                summary: Isolates several hosts; includes a comment
                value:
                  comment: 'Locked down, pending further investigation'
                  endpoint_ids:
                    - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                    - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                    - fa89271b-b9d4-43f2-a684-307cffddeb5a
              single_endpoint:
                summary: Isolates a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
              with_case_id:
                summary: Isolates a single host with a case_id value of 1234
                value:
                  case_ids:
                    - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: Isolating as initial response
                  endpoint_ids:
                    - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                    - b30a11bf-1395-4707-b508-fbb45ef9793e
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_IsolateRouteResponse'
              examples:
                IsolateSuccess:
                  summary: Isolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: isolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/kill_process:
    post:
      tags:
        - Security Endpoint Management API
      summary: Terminate a process
      description: Terminate a running process on an endpoint.
      operationId: EndpointKillProcessAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcessRouteRequestBody'
            examples:
              byEntityId:
                summary: Terminate a process by entity ID
                value:
                  comment: Terminating malicious process
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Terminate a process by PID
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                KillProcessSuccess:
                  summary: Kill process action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: kill-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/memory_dump:
    post:
      tags:
        - Security Endpoint Management API
      summary: Generate a memory dump from the host machine
      description: Generates memory dumps on the targeted host.
      operationId: EndpointGenerateMemoryDump
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDumpRouteRequestBody'
            examples:
              ProcessMemoryDump:
                summary: Generate a memory dump from the host machine
                value:
                  agent_type: endpoint
                  comment: Generating memory dump for investigation
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
                    type: process
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                MemoryDumpSuccessResponse:
                  summary: Memory dump action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: memory-dump
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        entity_id: abc123
                        type: process
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/run_script:
    post:
      tags:
        - Security Endpoint Management API
      summary: Run a script
      description: Run a script on a host. Currently supported only for some agent types.
      operationId: RunScriptAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_RunScriptRouteRequestBody'
            examples:
              Elastic Defend:
                summary: Run a script against an Elastic Defend agent
                description: Endpoint runscript to collect logs
                value:
                  agent_type: endpoint
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: '--path= /usr/log/exec.log'
              MDE:
                summary: Run a script against a Microsoft Defender Endpoint agent
                description: Microsoft Defender Endpoint runscript
                value:
                  agent_type: microsoft_defender_endpoint
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    args: '-param1 value1 -param2 value2'
                    scriptName: my-script.ps1
              SentinelOne:
                summary: Run a script against a SentinelOne agent
                description: SentinelOne runscript
                value:
                  agent_type: sentinel_one
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                    scriptInput: '--delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                RunScriptSuccess:
                  summary: Run script action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: sentinel_one
                      command: runscript
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/running_procs:
    post:
      tags:
        - Security Endpoint Management API
      summary: Get running processes
      description: Get a list of all processes running on an endpoint.
      operationId: EndpointGetProcessesAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_GetProcessesRouteRequestBody'
            examples:
              singleEndpoint:
                summary: Get running processes on a single endpoint
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                RunningProcsSuccess:
                  summary: Running processes action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: running-processes
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/scan:
    post:
      tags:
        - Security Endpoint Management API
      summary: Scan a file or directory
      description: Scan a specific file or directory on an endpoint for malware.
      operationId: EndpointScanAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_ScanRouteRequestBody'
            examples:
              scanFile:
                summary: Scan a file on an endpoint
                value:
                  comment: Scan the file for malware
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    path: /usr/my-file.txt
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                ScanSuccess:
                  summary: Scan action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: scan
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 27ba1b42-7cc6-4e53-86ce-675c876092b2
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        path: /usr/my-file.txt
                      startedAt: '2023-07-28T19:00:03.911Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/state:
    get:
      tags:
        - Security Endpoint Management API
      summary: Get actions state
      description: 'Get a response actions state, which reports whether encryption is enabled.'
      operationId: EndpointGetActionsState
      responses:
        '200':
          description: OK
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ActionStateSuccessResponse'
              examples:
                actionsState:
                  summary: Response actions state with encryption enabled
                  value:
                    data:
                      canEncrypt: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/suspend_process:
    post:
      tags:
        - Security Endpoint Management API
      summary: Suspend a process
      description: Suspend a running process on an endpoint.
      operationId: EndpointSuspendProcessAction
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcessRouteRequestBody'
            examples:
              byEntityId:
                summary: Suspend a process by entity ID
                value:
                  comment: Suspending suspicious process
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    entity_id: abc123
              byPid:
                summary: Suspend a process by PID
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  parameters:
                    pid: 1234
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                SuspendProcessSuccess:
                  summary: Suspend process action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: suspend-process
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        entity_id: abc123
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/unisolate:
    post:
      tags:
        - Security Endpoint Management API
      summary: Release an isolated endpoint
      description: 'Release an isolated endpoint, allowing it to rejoin a network.'
      operationId: EndpointUnisolateAction
      requestBody:
        content:
          application/json:
            schema:
              required:
                - endpoint_ids
              type: object
              properties:
                agent_type:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
                alert_ids:
                  maxItems: 50
                  minItems: 1
                  type: array
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
                  example:
                    - alert-id-1
                    - alert-id-2
                case_ids:
                  maxItems: 50
                  minItems: 1
                  type: array
                  items:
                    maxLength: 256
                    minLength: 1
                    type: string
                  description: The IDs of cases where the action taken will be logged. Max of 50.
                  example:
                    - case-id-1
                    - case-id-2
                comment:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
                endpoint_ids:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
                parameters:
                  $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
            examples:
              multipleHosts:
                summary: 'Releases several hosts; includes a comment:'
                value:
                  comment: 'Benign process identified, releasing group'
                  endpoint_ids:
                    - 9972d10e-4b9e-41aa-a534-a85e2a28ea42
                    - bc0e4f0c-3bca-4633-9fee-156c0b505d16
                    - fa89271b-b9d4-43f2-a684-307cffddeb5a
              singleHost:
                summary: Releases a single host with an endpoint_id value of ed518850-681a-4d60-bb98-e22640cae2a8
                value:
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
              withCaseId:
                summary: Releases hosts with an associated case; includes a comment.
                value:
                  case_ids:
                    - 4976be38-c134-4554-bd5e-0fd89ce63667
                  comment: 'Remediation complete, restoring network'
                  endpoint_ids:
                    - 1aa1f8fd-0fb0-4fe4-8c30-92068272d3f0
                    - b30a11bf-1395-4707-b508-fbb45ef9793e
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_UnisolateRouteResponse'
              examples:
                UnisolateSuccess:
                  summary: Unisolate action successfully created
                  value:
                    action: 233db9ea-6733-4849-9226-5a7039c7161d
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: unisolate
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: gke-node-1235412
                      id: 233db9ea-6733-4849-9226-5a7039c7161d
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      startedAt: '2022-07-29T19:08:49.126Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/action/upload:
    post:
      tags:
        - Security Endpoint Management API
      summary: Upload a file
      description: Upload a file to an endpoint.
      operationId: EndpointUploadAction
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_UploadRouteRequestBody'
            examples:
              uploadFile:
                summary: Upload a script file to a specific endpoint
                value:
                  comment: Pushing remediation script to host
                  endpoint_ids:
                    - ed518850-681a-4d60-bb98-e22640cae2a8
                  file: RWxhc3RpYw==
                  parameters:
                    overwrite: false
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse'
              examples:
                UploadSuccess:
                  summary: Upload action successfully created
                  value:
                    data:
                      agents:
                        - ed518850-681a-4d60-bb98-e22640cae2a8
                      agentState:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          isCompleted: false
                          wasSuccessful: false
                      agentType: endpoint
                      command: upload
                      createdBy: elastic
                      hosts:
                        ed518850-681a-4d60-bb98-e22640cae2a8:
                          name: Host-5i6cuc8kdv
                      id: 9ff6aebc-2cb6-481e-8869-9b30036c9731
                      isCompleted: false
                      isExpired: false
                      outputs: { }
                      parameters:
                        file_id: 10e4ce3d-4abb-4f93-a0cd-eaf63a489280
                        file_name: fix-malware.sh
                        file_sha256: a0bed94220193ba4895c0aa5b4e7e293381d15765cb164ddf7be5cdd010ae42a
                        file_size: 69
                      startedAt: '2023-07-03T15:07:22.837Z'
                      status: pending
                      wasSuccessful: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/metadata:
    get:
      tags:
        - Security Endpoint Management API
      summary: Get a metadata list
      description: Get a list of all endpoint host metadata.
      operationId: GetEndpointMetadataList
      parameters:
        - name: page
          in: query
          description: The page number to return.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
        - name: pageSize
          in: query
          description: The number of endpoints to return per page.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_PageSize'
        - name: kuery
          in: query
          description: A KQL string to filter the endpoint metadata results.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
        - name: hostStatuses
          in: query
          description: 'A set of host statuses to filter the results by (for example, `healthy`, `updating`).'
          required: true
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_HostStatuses'
        - name: sortField
          in: query
          description: The field used to sort the results.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_SortField'
        - name: sortDirection
          in: query
          description: 'The sort order, either `asc` or `desc`.'
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_MetadataListResponse'
              examples:
                metadataList:
                  summary: A list of endpoint host metadata
                  value:
                    data:
                      - host_status: healthy
                        last_checkin: '2023-07-04T15:47:57.432Z'
                        metadata:
                          agent:
                            id: 285297c6-3bff-4b83-9a07-f3e749801123
                            type: endpoint
                            version: '8.10.0'
                          Endpoint:
                            policy:
                              applied:
                                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                                name: test
                                status: success
                            status: enrolled
                          host:
                            hostname: WinDev2104Eval
                            os:
                              name: Windows
                              platform: windows
                              version: 20H2
                    page: 0
                    pageSize: 10
                    sortDirection: desc
                    sortField: enrolled_at
                    total: 1
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/metadata/{id}':
    get:
      tags:
        - Security Endpoint Management API
      summary: Get metadata
      description: Get host metadata for a specific endpoint.
      operationId: GetEndpointMetadata
      parameters:
        - name: id
          in: path
          description: The agent ID of the endpoint.
          required: true
          schema:
            maxLength: 256
            type: string
            example: ed518850-681a-4d60-bb98-e22640cae2a8
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointMetadataResponse'
              examples:
                endpointMetadata:
                  summary: Host metadata for a specific endpoint
                  value:
                    host_status: healthy
                    last_checkin: '2023-07-04T15:48:57.360Z'
                    metadata:
                      agent:
                        id: abb8a826-6812-448c-a571-6d8269b51449
                        type: endpoint
                        version: '8.10.0'
                      Endpoint:
                        policy:
                          applied:
                            id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                            name: test
                            status: success
                        status: enrolled
                      host:
                        hostname: WinDev2104Eval
                        os:
                          name: Windows
                          platform: windows
                          version: 20H2
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/policy_response:
    get:
      tags:
        - Security Endpoint Management API
      summary: Get a policy response
      description: Get the most recent policy response for an endpoint.
      operationId: GetPolicyResponse
      parameters:
        - name: agentId
          in: query
          description: The agent ID to retrieve the policy response for.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_SuccessResponse'
              examples:
                policyResponse:
                  summary: The most recent policy response for an endpoint
                  value:
                    policy_response:
                      '@timestamp': '2023-07-04T15:48:57.360Z'
                      agent:
                        id: ed518850-681a-4d60-bb98-e22640cae2a8
                        version: '7.16.0'
                      Endpoint:
                        policy:
                          applied:
                            endpoint_policy_version: '2'
                            id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                            name: My endpoint policy
                            status: success
                            version: '3'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/protection_updates_note/{package_policy_id}':
    get:
      tags:
        - Security Endpoint Management API
      summary: Get a protection updates note
      description: Get the protection updates note for a package policy.
      operationId: GetProtectionUpdatesNote
      parameters:
        - name: package_policy_id
          in: path
          description: The package policy ID to retrieve the protection updates note for.
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
              examples:
                protectionUpdatesNote:
                  summary: The protection updates note for a package policy
                  value:
                    note: Pinned protection updates to 2025-01-01 while validating new signatures.
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Endpoint Management API
      summary: Create or update a protection updates note
      description: Create or update the protection updates note for a package policy.
      operationId: CreateUpdateProtectionUpdatesNote
      parameters:
        - name: package_policy_id
          in: path
          description: The package policy ID to create or update the protection updates note for.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - note
              type: object
              properties:
                note:
                  maxLength: 10000
                  type: string
                  description: The note content.
            examples:
              setNote:
                summary: Set a new protection updates note
                value:
                  note: Pinned protection updates to 2025-01-01 while validating new signatures.
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse'
              examples:
                noteSaved:
                  summary: Protection updates note saved
                  value:
                    note: Pinned protection updates to 2025-01-01 while validating new signatures.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/endpoint/scripts_library:
    get:
      tags:
        - Security Endpoint Management API
      summary: Get a list of scripts
      description: Retrieve a list of scripts
      operationId: EndpointScriptLibraryListScripts
      parameters:
        - name: page
          in: query
          description: Page number of the results to return. Defaults to 1.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
        - name: pageSize
          in: query
          description: Number of results to return per page. Defaults to 10. Max value is 1000.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiPageSize'
        - name: sortField
          in: query
          description: The field to sort the results by. Defaults to name.
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiSortField'
        - name: sortDirection
          in: query
          description: The direction to sort the results by. Defaults to asc (ascending).
          schema:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
        - name: kuery
          in: query
          description: "A KQL query string to filter the list of scripts. Nearly all fields in the script object are searchable.\n"
          schema:
            allOf:
              - $ref: '#/components/schemas/Security_Endpoint_Management_API_Kuery'
              - example: platform:windows
      responses:
        '200':
          description: List of scripts response
          content:
            application/json:
              schema:
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScript'
                  page:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_Page'
                  pageSize:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiPageSize'
                  sortDirection:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_SortDirection'
                  sortField:
                    $ref: '#/components/schemas/Security_Endpoint_Management_API_ApiSortField'
                  total:
                    type: integer
                    description: The total number of scripts matching the query
              examples:
                response:
                  summary: List of scripts response example
                  value:
                    data: [ ]
                    page: 1
                    pageSize: 10
                    sortDirection: asc
                    sortField: name
                    total: 100
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Endpoint Management API
      summary: Create script
      description: Create a new script entry by uploading a script file
      operationId: EndpointScriptLibraryCreateScript
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_CreateScriptRouteRequestBody'
            examples:
              CreateArchiveScriptEntry:
                summary: Create an archive script entry
                value:
                  description: Collects host data for investigation
                  example: ./collect_host_data.sh --help
                  file: ./collect_host_data.zip
                  fileType: archive
                  instructions: Collects host data for investigation
                  name: Collect host data
                  pathToExecutable: ./bin/collect_host_data.sh
                  platform:
                    - linux
                    - macos
                  requiresInput: false
              CreateScriptEntry:
                summary: Create a script entry
                value:
                  description: Collects host data for investigation
                  example: ./collect_host_data.sh --help
                  file: ./collect_host_data.sh
                  fileType: script
                  instructions: Collects host data for investigation
                  name: Collect host data
                  platform:
                    - linux
                    - macos
                  requiresInput: false
        required: true
      responses:
        '200':
          description: Action request was successfully created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
              examples:
                CreateScriptEntrySuccess:
                  summary: Create a script entry
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                        - linux
                        - macos
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/scripts_library/{script_id}':
    delete:
      tags:
        - Security Endpoint Management API
      summary: Delete a script
      description: Delete a script
      operationId: EndpointScriptLibraryDeleteScript
      parameters:
        - name: script_id
          in: path
          description: The ID of the script entry to be deleted.
          required: true
          schema:
            maxLength: 256
            type: string
            description: The ID of the script entry to be deleted.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
          example: fr518850-681a-4y60-aa98-e22640cae2b8
      responses:
        '200':
          description: Delete script response.
          content:
            application/json:
              schema:
                type: object
              examples:
                response:
                  summary: Delete script response example.
                  value: { }
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Endpoint Management API
      summary: Get script
      description: Get a script
      operationId: EndpointScriptLibraryGetOneScript
      parameters:
        - name: script_id
          in: path
          description: The ID of the script entry.
          required: true
          schema:
            maxLength: 256
            type: string
            description: The ID of the script entry.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
          example: fr518850-681a-4y60-aa98-e22640cae2b8
      responses:
        '200':
          description: Get script response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
              examples:
                UpdateScriptEntrySuccess:
                  summary: Get one script entry success
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                        - linux
                        - macos
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - Security Endpoint Management API
      summary: Update script
      description: Update (full or partial) a script entry
      operationId: EndpointScriptLibraryPatchUpdateScript
      parameters:
        - name: script_id
          in: path
          description: The ID of the script entry to be updated.
          required: true
          schema:
            maxLength: 256
            type: string
            description: The ID of the script entry to be updated.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
          example: fr518850-681a-4y60-aa98-e22640cae2b8
      requestBody:
        content:
          multipart/form-data:
            schema:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PatchUpdateScriptRouteRequestBody'
            examples:
              PatchUpdateScriptEntry:
                summary: Update script entry instructions
                value:
                  instructions: ./collect_host_data.sh --help
              PatchUpdateScriptEntryFromArchiveToScript:
                summary: Update script entry from an archive to a script
                value:
                  fileType: script
              PatchUpdateScriptEntryToArchive:
                summary: Update script entry to be an archive
                value:
                  fileType: archive
                  pathToExecutable: ./bin/collect_host_data.sh
        required: true
      responses:
        '200':
          description: Action request was successfully updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptsApiResponse'
              examples:
                UpdateScriptEntrySuccess:
                  summary: Update script entry success
                  value:
                    data:
                      description: Collects host data for investigation
                      file: ./collect_host_data.sh
                      fileType: script
                      id: 1234567890
                      instructions: No arguments required
                      name: Collect host data
                      platform:
                        - linux
                        - macos
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/endpoint/scripts_library/{script_id}/download':
    get:
      tags:
        - Security Endpoint Management API
      summary: Download a script file
      description: Download a script file
      operationId: EndpointScriptLibraryDownloadScript
      parameters:
        - name: script_id
          in: path
          description: The ID of the script entry.
          required: true
          schema:
            maxLength: 256
            type: string
            description: The ID of the script entry.
            example: fr518850-681a-4y60-aa98-e22640cae2b8
          example: fr518850-681a-4y60-aa98-e22640cae2b8
      responses:
        '200':
          description: Download script file response.
          content:
            application/octet-stream:
              schema:
                type: string
                description: A download stream is returned.
                format: binary
              examples:
                response:
                  summary: Download script file response example.
                  value: 'null'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/delete:
    delete:
      tags:
        - Security Entity Analytics API
      summary: Delete the Privilege Monitoring Engine
      description: '**Deprecated in 9.4.0.** Deletes the Privilege Monitoring Engine and optionally removes all associated privileged user data.'
      operationId: DeleteMonitoringEngine
      parameters:
        - name: data
          in: query
          description: Whether to delete all the privileged user data
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - deleted
                type: object
                properties:
                  deleted:
                    type: boolean
              examples:
                DeleteMonitoringEngineResponse:
                  summary: Engine deleted successfully
                  value:
                    deleted: true
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/disable:
    post:
      tags:
        - Security Entity Analytics API
      summary: Disable the Privilege Monitoring Engine
      description: '**Deprecated in 9.4.0.** Disables the Privilege Monitoring Engine, stopping all monitoring activity without removing data.'
      operationId: DisableMonitoringEngine
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
              examples:
                DisableMonitoringEngineResponse:
                  summary: Engine disabled successfully
                  value:
                    status: disabled
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/init:
    post:
      tags:
        - Security Entity Analytics API
      summary: Initialize the Privilege Monitoring Engine
      description: '**Deprecated in 9.4.0.** Initializes the Privilege Monitoring Engine, setting up the required resources and starting the engine.'
      operationId: InitMonitoringEngine
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
              examples:
                InitMonitoringEngineResponse:
                  summary: Engine initialized successfully
                  value:
                    status: started
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEngineDescriptor'
              examples:
                InitMonitoringEngineError:
                  summary: Internal server error during engine initialization
                  value:
                    error:
                      message: Failed to initialize monitoring engine
                    status: error
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/engine/schedule_now:
    post:
      tags:
        - Security Entity Analytics API
      summary: Schedule the Privilege Monitoring Engine
      description: '**Deprecated in 9.4.0.** Schedules the Privilege Monitoring Engine to run as soon as possible, triggering an immediate monitoring cycle.'
      operationId: ScheduleMonitoringEngine
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  success:
                    type: boolean
                    description: Indicates the scheduling was successful
              examples:
                ScheduleMonitoringEngineResponse:
                  summary: Engine scheduled successfully
                  value:
                    success: true
        '409':
          description: Conflict - Monitoring engine is already running
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    description: Error message indicating the engine is already running
              examples:
                ScheduleMonitoringEngineConflict:
                  summary: Engine is already running
                  value:
                    message: Monitoring engine is already running
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/privileges/health:
    get:
      tags:
        - Security Entity Analytics API
      summary: Health check on Privilege Monitoring
      description: '**Deprecated in 9.4.0.** Returns the current health status of the Privilege Monitoring Engine, including engine status, error details, and user count statistics.'
      operationId: PrivMonHealth
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - status
                type: object
                properties:
                  error:
                    required:
                      - status
                    type: object
                    properties:
                      message:
                        type: string
                  status:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus'
                  users:
                    required:
                      - current_count
                      - max_allowed
                    type: object
                    properties:
                      current_count:
                        type: integer
                        description: Current number of privileged users being monitored
                      max_allowed:
                        type: integer
                        description: Maximum number of privileged users allowed to be monitored
                    description: User statistics for privilege monitoring
              examples:
                PrivMonHealthResponse:
                  summary: Healthy privilege monitoring engine
                  value:
                    status: started
                    users:
                      current_count: 42
                      max_allowed: 1000
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/privileges/privileges:
    get:
      tags:
        - Security Entity Analytics API
      summary: Run a privileges check on Privilege Monitoring
      description: "**Deprecated in 9.4.0.** Use the Watchlists APIs instead.\n\nCheck if the current user has all required permissions for Privilege Monitoring.\n"
      operationId: PrivMonPrivileges
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivileges'
              examples:
                PrivMonPrivilegesResponse:
                  summary: Privileges check response
                  value:
                    has_all_required: true
                    privileges:
                      elasticsearch:
                        index:
                          .entity_analytics.monitoring.user-default:
                            read: true
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users:
    post:
      tags:
        - Security Entity Analytics API
      summary: Create a new monitored user
      description: "**Deprecated in 9.4.0.** Use the Watchlists API instead.\n\nCreates a new privileged user to be monitored by the Privilege Monitoring Engine.\n"
      operationId: CreatePrivMonUser
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_UserName'
            examples:
              CreatePrivMonUserRequest:
                summary: Create a monitored user
                value:
                  entity_analytics_monitoring:
                    labels:
                      - field: department
                        source: api
                        value: IT
                  user:
                    name: john.doe
        required: true
      responses:
        '200':
          description: User created successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
              examples:
                CreatePrivMonUserResponse:
                  summary: Created monitored user
                  value:
                    '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                        - field: department
                          source: api
                          value: IT
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users/_csv:
    post:
      tags:
        - Security Entity Analytics API
      summary: Upsert multiple monitored users via CSV upload
      description: "**Deprecated in 9.4.0.** Use the Watchlists API instead.\n\nBulk upserts privileged users by uploading a CSV file. Returns per-row errors and aggregate upload statistics.\n"
      operationId: PrivmonBulkUploadUsersCSV
      requestBody:
        content:
          multipart/form-data:
            schema:
              required:
                - file
              type: object
              properties:
                file:
                  type: string
                  description: The CSV file to upload.
                  format: binary
            examples:
              PrivmonBulkUploadUsersCSVRequest:
                summary: CSV file with privileged users
                value:
                  file: "username,is_privileged\njohn.doe,true\njane.smith,true\n"
      responses:
        '200':
          description: Bulk upload successful
          content:
            application/json:
              schema:
                required:
                  - errors
                  - stats
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem'
                  stats:
                    $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivmonUserCsvUploadStats'
              examples:
                PrivmonBulkUploadUsersCSVResponse:
                  summary: Bulk upload response with mixed results
                  value:
                    errors:
                      - index: 1
                        message: Invalid monitored field
                        username: john.doe
                    stats:
                      failedOperations: 1
                      successfulOperations: 1
                      totalOperations: 2
                      uploaded: 2
        '413':
          description: File too large
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/entity_analytics/monitoring/users/{id}':
    delete:
      tags:
        - Security Entity Analytics API
      summary: Delete a monitored user
      description: "**Deprecated in 9.4.0.** Use the Watchlists API instead.\n\nRemoves a privileged user from monitoring by their document ID.\n"
      operationId: DeletePrivMonUser
      parameters:
        - name: id
          in: path
          description: The document ID of the monitored user to delete
          required: true
          schema:
            type: string
      responses:
        '200':
          description: User deleted successfully
          content:
            application/json:
              schema:
                required:
                  - success
                type: object
                properties:
                  acknowledged:
                    type: boolean
                    description: Indicates if the deletion was successful
                  message:
                    type: string
                    description: A message providing additional information about the deletion status
              examples:
                DeletePrivMonUserResponse:
                  summary: User deleted successfully
                  value:
                    acknowledged: true
                    message: User deleted successfully
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Entity Analytics API
      summary: Update a monitored user
      description: "**Deprecated in 9.4.0.** Use the Watchlists API instead.\n\nUpdates the details of an existing monitored privileged user by their document ID.\n"
      operationId: UpdatePrivMonUser
      parameters:
        - name: id
          in: path
          description: The document ID of the monitored user to update
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserUpdateDoc'
            examples:
              UpdatePrivMonUserRequest:
                summary: Update a monitored user
                value:
                  entity_analytics_monitoring:
                    labels:
                      - field: department
                        source: api
                        value: Security
                  user:
                    is_privileged: true
                    name: john.doe
        required: true
      responses:
        '200':
          description: User updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
              examples:
                UpdatePrivMonUserResponse:
                  summary: Updated monitored user
                  value:
                    '@timestamp': '2026-01-28T12:00:00.000Z'
                    entity_analytics_monitoring:
                      labels:
                        - field: department
                          source: api
                          value: Security
                    event:
                      ingested: '2026-01-28T12:00:00.000Z'
                    id: user-abc-123
                    user:
                      is_privileged: true
                      name: john.doe
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/monitoring/users/list:
    get:
      tags:
        - Security Entity Analytics API
      summary: List all monitored users
      description: "**Deprecated in 9.4.0.** Use the Watchlists API instead.\n\nReturns a list of all privileged users currently being monitored. Supports optional KQL filtering.\n"
      operationId: ListPrivMonUsers
      parameters:
        - name: kql
          in: query
          description: KQL query to filter the list of monitored users
          schema:
            type: string
      responses:
        '200':
          description: List of monitored users
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserDoc'
              examples:
                ListPrivMonUsersResponse:
                  summary: List of monitored users
                  value:
                    - '@timestamp': '2026-01-28T12:00:00.000Z'
                      entity_analytics_monitoring:
                        labels:
                          - field: department
                            source: api
                            value: IT
                      event:
                        ingested: '2026-01-28T12:00:00.000Z'
                      id: user-abc-123
                      user:
                        is_privileged: true
                        name: john.doe
                    - '@timestamp': '2026-01-15T09:00:00.000Z'
                      entity_analytics_monitoring:
                        labels:
                          - field: department
                            source: csv
                            value: Security
                      event:
                        ingested: '2026-01-15T09:00:00.000Z'
                      id: user-def-456
                      user:
                        is_privileged: true
                        name: jane.smith
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/privileged_user_monitoring/pad/install:
    post:
      tags:
        - Security Entity Analytics API
      summary: Installs the privileged access detection package for the Entity Analytics privileged user monitoring experience
      description: Installs the privileged access detection integration package and sets up the associated ML modules required for the Entity Analytics privileged user monitoring experience.
      operationId: InstallPrivilegedAccessDetectionPackage
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
              examples:
                InstallPrivilegedAccessDetectionPackageResponse:
                  summary: Package installed successfully
                  value:
                    message: Privileged access detection package installed successfully
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/privileged_user_monitoring/pad/status:
    get:
      tags:
        - Security Entity Analytics API
      summary: Gets the status of the privileged access detection package for the Entity Analytics privileged user monitoring experience
      description: 'Returns the installation and ML module setup status of the privileged access detection package, along with the state of each associated ML job.'
      operationId: GetPrivilegedAccessDetectionPackageStatus
      responses:
        '200':
          description: Privileged access detection status retrieved
          content:
            application/json:
              schema:
                required:
                  - package_installation_status
                  - ml_module_setup_status
                  - jobs
                type: object
                properties:
                  jobs:
                    type: array
                    items:
                      required:
                        - job_id
                        - state
                      type: object
                      properties:
                        description:
                          type: string
                        job_id:
                          type: string
                        state:
                          enum:
                            - closing
                            - closed
                            - opened
                            - failed
                            - opening
                          type: string
                  ml_module_setup_status:
                    enum:
                      - complete
                      - incomplete
                    type: string
                  package_installation_status:
                    enum:
                      - complete
                      - incomplete
                    type: string
              examples:
                GetPrivilegedAccessDetectionPackageStatusResponse:
                  summary: Package fully installed and running
                  value:
                    jobs:
                      - description: Detects high-risk login patterns
                        job_id: pad-high-risk-login
                        state: opened
                      - description: Detects privilege escalation events
                        job_id: pad-privilege-escalation
                        state: opened
                    ml_module_setup_status: complete
                    package_installation_status: complete
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists:
    post:
      tags:
        - Security Entity Analytics API
      summary: Create a new watchlist
      description: Creates a new entity analytics watchlist with an optional set of entity sources. Watchlists apply a risk score modifier to matched entities.
      operationId: CreateWatchlist
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - riskModifier
              type: object
              properties:
                description:
                  maxLength: 1000
                  type: string
                  description: Description of the watchlist
                entitySources:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - type
                      - name
                    type: object
                    properties:
                      enabled:
                        type: boolean
                      filter:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_Filter'
                      identifierField:
                        maxLength: 256
                        type: string
                        description: Field used to query the entity store for index-type sources
                      indexPattern:
                        maxLength: 1000
                        type: string
                      integrationName:
                        maxLength: 256
                        type: string
                        description: 'Required when type is entity_analytics_integration. One of entityanalytics_okta, entityanalytics_ad.'
                      matchers:
                        maxItems: 100
                        type: array
                        items:
                          $ref: '#/components/schemas/Security_Entity_Analytics_API_Matcher'
                      name:
                        maxLength: 256
                        type: string
                      queryRule:
                        maxLength: 4096
                        type: string
                        description: KQL query used to filter data from the provided index patterns
                      range:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_DateRange'
                      type:
                        $ref: '#/components/schemas/Security_Entity_Analytics_API_EntitySourceType'
                    additionalProperties: false
                  description: Optional entity sources to create and link to the watchlist
                managed:
                  type: boolean
                  description: Indicates if the watchlist is managed by the system
                name:
                  maxLength: 256
                  type: string
                  description: Unique name for the watchlist
                riskModifier:
                  maximum: 2
                  minimum: 0
                  type: number
                  description: Risk score modifier associated with the watchlist
            examples:
              CreateWatchlistRequest:
                summary: Create watchlist request
                value:
                  description: High risk vendor watchlist
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
              CreateWatchlistWithSourcesRequest:
                summary: Create watchlist with entity sources
                value:
                  description: High risk vendor watchlist
                  entitySources:
                    - enabled: true
                      identifierField: user.name
                      indexPattern: my-sync-index
                      name: My User Index Source
                      type: index
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
        required: true
      responses:
        '200':
          description: Watchlist created successfully
          content:
            application/json:
              schema:
                allOf:
                  - $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
                  - type: object
                    properties:
                      entitySources:
                        type: array
                        items:
                          $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEntitySource'
              examples:
                CreateWatchlistResponse:
                  summary: Created watchlist
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-01-28T12:00:00.000Z'
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/entity_analytics/watchlists/{id}':
    get:
      tags:
        - Security Entity Analytics API
      summary: Get a watchlist by ID
      description: Retrieves the details of an entity analytics watchlist by its unique identifier.
      operationId: GetWatchlist
      parameters:
        - name: id
          in: path
          description: Unique ID of the watchlist
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Watchlist details
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
              examples:
                GetWatchlistResponse:
                  summary: Watchlist details
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Entity Analytics API
      summary: Update an existing watchlist
      description: 'Updates the name, description, risk modifier, or managed status of an existing entity analytics watchlist.'
      operationId: UpdateWatchlist
      parameters:
        - name: id
          in: path
          description: The ID of the watchlist to update
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - riskModifier
              type: object
              properties:
                description:
                  maxLength: 1000
                  type: string
                  description: Description of the watchlist
                managed:
                  type: boolean
                  description: Indicates if the watchlist is managed by the system
                name:
                  maxLength: 256
                  type: string
                  description: Unique name of the watchlist
                riskModifier:
                  maximum: 2
                  minimum: 0
                  type: number
                  description: Risk score modifier associated with the watchlist
            examples:
              UpdateWatchlistRequest:
                summary: Update watchlist request
                value:
                  description: High risk vendor watchlist
                  managed: false
                  name: High Risk Vendors
                  riskModifier: 1.5
        required: true
      responses:
        '200':
          description: Watchlist updated successfully
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
              examples:
                UpdateWatchlistResponse:
                  summary: Updated watchlist
                  value:
                    createdAt: '2026-01-28T12:00:00.000Z'
                    description: High risk vendor watchlist
                    id: watchlist-123
                    managed: false
                    name: High Risk Vendors
                    riskModifier: 1.5
                    updatedAt: '2026-02-18T12:00:00.000Z'
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/entity_analytics/watchlists/{watchlist_id}/csv_upload':
    post:
      tags:
        - Security Entity Analytics API
      summary: Upload a CSV file to add entities to a watchlist
      description: "Uploads a CSV file to add entities to a watchlist. The CSV must contain a header row\nwith a \"type\" column (user, host, service, or generic) and one or more ECS identity\nfields (e.g. \"user.name\", \"host.hostname\") used to match entities in the entity store.\n\nMatched entities are added to the watchlist and their `entity.attributes.watchlists`\nfield is updated in the entity store.\n\nEach row will match up to 10,000 entities.\n"
      operationId: UploadWatchlistCsv
      parameters:
        - name: watchlist_id
          in: path
          description: The ID of the watchlist to add entities to
          required: true
          schema:
            type: string
          example: high-risk-vendors
      requestBody:
        content:
          multipart/form-data:
            schema:
              required:
                - file
              type: object
              properties:
                file:
                  type: string
                  description: The CSV file to upload.
                  format: binary
            examples:
              csvUpload:
                summary: CSV file with user entities
                value:
                  file: "type,user.name\nuser,john.doe\nuser,jane.smith\n"
        required: true
      responses:
        '200':
          description: Upload successful
          content:
            application/json:
              schema:
                required:
                  - successful
                  - failed
                  - total
                  - unmatched
                  - items
                type: object
                properties:
                  failed:
                    type: integer
                    description: Number of rows that failed to process
                    example: 1
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem'
                  successful:
                    type: integer
                    description: Number of rows that matched at least one entity
                    example: 1
                  total:
                    type: integer
                    description: Total number of rows processed
                    example: 3
                  unmatched:
                    type: integer
                    description: Number of rows that matched no entities
                    example: 1
              examples:
                CsvUploadResponse:
                  summary: CSV upload response with mixed results
                  value:
                    failed: 1
                    items:
                      - matchedEntities: 1
                        status: success
                      - error: Invalid entity type
                        matchedEntities: 0
                        status: failure
                      - matchedEntities: 0
                        status: unmatched
                    successful: 1
                    total: 3
                    unmatched: 1
        '413':
          description: File too large
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/entity_analytics/watchlists/{watchlist_id}/entities/assign':
    post:
      tags:
        - Security Entity Analytics API
      summary: Manually assign entities to a watchlist
      description: "Assigns the provided entities to the specified watchlist using a \"manual\" source label.\nThe entities must already exist in the entity store.\n\nIf an entity is already on the watchlist, no new document is created — the \"manual\" label\nis added to its existing source labels instead.\n"
      operationId: AssignWatchlistEntities
      parameters:
        - name: watchlist_id
          in: path
          description: The ID of the watchlist to add entities to
          required: true
          schema:
            type: string
          example: high-risk-vendors
      requestBody:
        content:
          application/json:
            schema:
              required:
                - euids
              type: object
              properties:
                euids:
                  type: array
                  items:
                    type: string
                  description: The EUIDs of the entities to assign
                  example:
                    - user:john.doe
                    - host:web-01
            examples:
              assignEntities:
                summary: Assign two entities to a watchlist
                value:
                  euids:
                    - user:john.doe
                    - host:web-01
        required: true
      responses:
        '200':
          description: Assignment successful
          content:
            application/json:
              schema:
                required:
                  - successful
                  - failed
                  - not_found
                  - total
                  - items
                type: object
                properties:
                  failed:
                    type: integer
                    description: Number of entities that failed to process
                    example: 0
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem'
                  not_found:
                    type: integer
                    description: Number of entities not found in the entity store
                    example: 1
                  successful:
                    type: integer
                    description: Number of entities successfully assigned
                    example: 1
                  total:
                    type: integer
                    description: Total number of entities processed
                    example: 2
              examples:
                assignEntitiesResponse:
                  summary: Successful assignment of two entities
                  value:
                    failed: 0
                    items:
                      - euid: user:john.doe
                        status: success
                      - euid: host:web-01
                        status: not_found
                    not_found: 1
                    successful: 1
                    total: 2
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/entity_analytics/watchlists/{watchlist_id}/entities/unassign':
    post:
      tags:
        - Security Entity Analytics API
      summary: Manually unassign entities from a watchlist
      description: "Unassigns the provided entities from the specified watchlist.\nThis only removes the \"manual\" assignment. If the entity is also\nassigned via other sources (for example, index or integration), it will\nremain on the watchlist.\n"
      operationId: UnassignWatchlistEntities
      parameters:
        - name: watchlist_id
          in: path
          description: The ID of the watchlist to remove entities from
          required: true
          schema:
            type: string
          example: high-risk-vendors
      requestBody:
        content:
          application/json:
            schema:
              required:
                - euids
              type: object
              properties:
                euids:
                  type: array
                  items:
                    type: string
                  description: The EUIDs of the entities to unassign
                  example:
                    - user:john.doe
                    - host:web-01
            examples:
              unassignEntities:
                summary: Unassign two entities from a watchlist
                value:
                  euids:
                    - user:john.doe
                    - host:web-01
        required: true
      responses:
        '200':
          description: Unassignment successful
          content:
            application/json:
              schema:
                required:
                  - successful
                  - failed
                  - not_found
                  - total
                  - items
                type: object
                properties:
                  failed:
                    type: integer
                    description: Number of entities that failed to process
                    example: 0
                  items:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem'
                  not_found:
                    type: integer
                    description: Number of entities not found in the manual watchlist assignment
                    example: 1
                  successful:
                    type: integer
                    description: Number of entities successfully unassigned
                    example: 1
                  total:
                    type: integer
                    description: Total number of entities processed
                    example: 2
              examples:
                unassignEntitiesResponse:
                  summary: Successful unassignment of two entities
                  value:
                    failed: 0
                    items:
                      - euid: user:john.doe
                        status: success
                      - euid: host:web-01
                        status: not_found
                    not_found: 1
                    successful: 1
                    total: 2
      x-state: Technical Preview; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/entity_analytics/watchlists/list:
    get:
      tags:
        - Security Entity Analytics API
      summary: List all watchlists
      description: Returns a list of all entity analytics watchlists.
      operationId: ListWatchlists
      responses:
        '200':
          description: List of watchlists
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_WatchlistObject'
              examples:
                ListWatchlistsResponse:
                  summary: List of watchlists
                  value:
                    - createdAt: '2026-01-28T12:00:00.000Z'
                      description: High risk vendor watchlist
                      id: watchlist-123
                      managed: false
                      name: High Risk Vendors
                      riskModifier: 1.5
                      updatedAt: '2026-02-18T12:00:00.000Z'
                    - createdAt: '2026-01-10T09:30:00.000Z'
                      description: Privileged user monitoring watchlist
                      id: watchlist-456
                      managed: true
                      name: Privileged Accounts
                      riskModifier: 2
                      updatedAt: '2026-02-01T15:45:00.000Z'
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists:
    delete:
      tags:
        - Security Exceptions API
      summary: Delete an exception list
      description: "Delete an exception list using the `id` or `list_id` field.\n\nBefore deleting an exception list that is linked to detection rules, remove or unlink the\nexception list from those rules. Deleting a linked exception list can leave rules referencing\nan exception list that no longer exists.\n"
      operationId: DeleteExceptionList
      parameters:
        - name: id
          in: query
          description: Exception list's identifier. Either `id` or `list_id` must be specified.
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - name: list_id
          in: query
          description: 'Human readable exception list string identifier, e.g. `trusted-linux-processes`. Either `id` or `list_id` must be specified.'
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
          examples:
            autogeneratedId:
              value: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
            list_id:
              value: simple_list
        - name: namespace_type
          in: query
          description: "`single` deletes the list in the current Kibana space; `agnostic` deletes a global list. Must match the\nlist you are removing when using `list_id` or `id`.\n"
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
              examples:
                detectionExceptionList:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [DELETE /api/exception_lists?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Exception list not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list list_id: "foo" does not exist'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Exceptions API
      summary: Get exception list details
      description: Get the details of an exception list using the `id` or `list_id` field.
      operationId: ReadExceptionList
      parameters:
        - name: id
          in: query
          description: Exception list's identifier. Either `id` or `list_id` must be specified.
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - name: list_id
          in: query
          description: 'Human readable exception list string identifier, e.g. `trusted-linux-processes`. Either `id` or `list_id` must be specified.'
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - name: namespace_type
          in: query
          description: "When `single`, the list is resolved in the current Kibana space. When `agnostic`, the list is a global\n(space-agnostic) container. Required for looking up the correct list when `list_id` is not unique.\n"
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
              examples:
                detectionType:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/exception_lists?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: Exception list item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Exceptions API
      summary: Create an exception list
      description: "An exception list groups exception items and can be associated with detection rules. You can assign exception lists to multiple detection rules.\n> info\n> All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.\n"
      operationId: CreateExceptionList
      requestBody:
        description: Exception list's properties
        content:
          application/json:
            schema:
              required:
                - name
                - description
                - type
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                list_id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
                namespace_type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
                os_types:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
                tags:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
                type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
                version:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
              example:
                description: This is a sample detection type exception list.
                list_id: simple_list
                name: Sample Detection Exception List
                namespace_type: single
                os_types:
                  - linux
                tags:
                  - malware
                type: detection
            examples:
              createDetection:
                value:
                  description: This is a sample detection type exception list.
                  list_id: simple_list
                  name: Sample Detection Exception List
                  namespace_type: single
                  os_types:
                    - linux
                  tags:
                    - malware
                  type: detection
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
              examples:
                autogeneratedListId:
                  value:
                    _version: WzMsMV0=
                    created_at: '2025-01-09T01:05:23.019Z'
                    created_by: elastic
                    description: This is a sample detection type exception with an autogenerated list_id.
                    id: 28243c2f-624a-4443-823d-c0b894880931
                    immutable: false
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types: [ ]
                    tags:
                      - malware
                    tie_breaker_id: ad94de31-39f7-4ad7-b8e4-988bfa95f338
                    type: detection
                    updated_at: '2025-01-09T01:05:23.020Z'
                    updated_by: elastic
                    version: 1
                namespaceAgnostic:
                  value:
                    _version: WzUsMV0=
                    created_at: '2025-01-09T01:10:36.369Z'
                    created_by: elastic
                    description: This is a sample agnostic endpoint type exception.
                    id: 1a744e77-22ca-4b6b-9085-54f55275ebe5
                    immutable: false
                    list_id: b935eb55-7b21-4c1c-b235-faa1df23b3d6
                    name: Sample Agnostic Endpoint Exception List
                    namespace_type: agnostic
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 49ea0adc-a2b8-4d83-a8f3-2fb98301dea3
                    type: endpoint
                    updated_at: '2025-01-09T01:10:36.369Z'
                    updated_by: elastic
                    version: 1
                typeDetection:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
                typeEndpoint:
                  value:
                    _version: WzQsMV0=
                    created_at: '2025-01-09T01:07:49.658Z'
                    created_by: elastic
                    description: This is a sample endpoint type exception list.
                    id: a79f4730-6e32-4278-abfc-349c0add7d54
                    immutable: false
                    list_id: endpoint_list
                    name: Sample Endpoint Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 94a028af-8f47-427a-aca5-ffaf829e64ee
                    type: endpoint
                    updated_at: '2025-01-09T01:07:49.658Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '409':
          description: Exception list already exists response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'exception list id: "simple_list" already exists'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Exceptions API
      summary: Update an exception list
      description: Update an exception list using the `id` or `list_id` field.
      operationId: UpdateExceptionList
      requestBody:
        description: Exception list's properties
        content:
          application/json:
            schema:
              required:
                - name
                - description
                - type
              type: object
              properties:
                _version:
                  type: string
                  description: 'The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.'
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
                list_id:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
                meta:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
                namespace_type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
                os_types:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
                tags:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
                type:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
                version:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
              example:
                description: Different description
                list_id: simple_list
                name: Updated exception list name
                os_types:
                  - linux
                tags:
                  - draft malware
                type: detection
            examples:
              fullReplace:
                value:
                  description: Different description
                  list_id: simple_list
                  name: Updated exception list name
                  os_types:
                    - linux
                  tags:
                    - draft
                    - malware
                  type: detection
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
              examples:
                simpleList:
                  value:
                    _version: WzExLDFd
                    created_at: '2025-01-07T20:43:55.264Z'
                    created_by: elastic
                    description: Different description
                    id: fa7f545f-191b-4d32-b1f0-c7cd62a79e55
                    immutable: false
                    list_id: simple_list
                    name: Updated exception list name
                    namespace_type: single
                    os_types: [ ]
                    tags:
                      - draft malware
                    tie_breaker_id: 319fe983-acdd-4806-b6c4-3098eae9392f
                    type: detection
                    updated_at: '2025-01-07T21:32:03.726Z'
                    updated_by: elastic
                    version: 2
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PUT /api/exception_lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Exception list not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_duplicate:
    post:
      tags:
        - Security Exceptions API
      summary: Duplicate an exception list
      description: Duplicate an existing exception list.
      operationId: DuplicateExceptionList
      parameters:
        - name: list_id
          in: query
          description: The `list_id` of the existing exception list to copy (source list).
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - name: namespace_type
          in: query
          description: 'Scope in which the source list is defined (`single` = current space, `agnostic` = all spaces).'
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
        - name: include_expired_exceptions
          in: query
          description: Determines whether to include expired exceptions in the duplicated list. Expiration date defined by `expire_time`.
          required: true
          schema:
            enum:
              - 'true'
              - 'false'
            type: string
            default: 'true'
            example: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
              examples:
                detectionExceptionList:
                  value:
                    _version: WzExNDY1LDFd
                    created_at: '2025-01-09T16:19:50.280Z'
                    created_by: elastic
                    description: This is a sample detection type exception
                    id: b2f4a715-6ab1-444c-8b1e-3fa1b1049429
                    immutable: false
                    list_id: d6390d60-bce3-4a48-9002-52db600f329c
                    name: 'Sample Detection Exception List [Duplicate]'
                    namespace_type: single
                    os_types: [ ]
                    tags:
                      - malware
                    tie_breaker_id: 6fa670bd-666d-4c9c-9f1e-d1dbc516e985
                    type: detection
                    updated_at: '2025-01-09T16:19:50.280Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type: Invalid enum value. Expected ''agnostic'' | ''single'', received ''foo'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/exception_lists/_duplicate] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Exception list not found
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list id: "foo" does not exist'
                    status_code: 404
        '405':
          description: Exception list to duplicate not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notAllowed:
                  value:
                    message: 'Cannot duplicate: list is immutable or the operation is not allowed in this state'
                    status_code: 405
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_export:
    post:
      tags:
        - Security Exceptions API
      summary: Export an exception list
      description: Export an exception list and its associated items to an NDJSON file.
      operationId: ExportExceptionList
      parameters:
        - name: id
          in: query
          description: Exception list's internal `id` (UUID) returned on create; use with `list_id` and `namespace_type` for an unambiguous target.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - name: list_id
          in: query
          description: 'Human-readable `list_id` of the exception list to export, as shown in the UI and API responses.'
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - name: namespace_type
          in: query
          description: "`single` exports a list in the current Kibana space; `agnostic` exports a global (space-agnostic) list.\n"
          required: true
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
        - name: include_expired_exceptions
          in: query
          description: Determines whether to include expired exceptions in the exported list. Expiration date defined by `expire_time`.
          required: true
          schema:
            enum:
              - 'true'
              - 'false'
            type: string
            default: 'true'
          example: true
      responses:
        '200':
          description: Successful response
          content:
            application/ndjson:
              schema:
                type: string
                description: A `.ndjson` file containing specified exception list and its items
                format: binary
              examples:
                exportSavedObjectsResponse:
                  value: "{\"_version\":\"WzExNDU5LDFd\",\"created_at\":\"2025-01-09T16:18:17.757Z\",\"created_by\":\"elastic\",\"description\":\"This is a sample detection type exception\",\"id\":\"c86c2da0-2ab6-4343-b81c-216ef27e8d75\",\"immutable\":false,\"list_id\":\"simple_list\",\"name\":\"Sample Detection Exception List\",\"namespace_type\":\"single\",\"os_types\":[],\"tags\":[\"user added string for a tag\",\"malware\"],\"tie_breaker_id\":\"cf4a7b92-732d-47f0-a0d5-49a35a1736bf\",\"type\":\"detection\",\"updated_at\":\"2025-01-09T16:18:17.757Z\",\"updated_by\":\"elastic\",\"version\":1}\n{\"_version\":\"WzExNDYxLDFd\",\"comments\":[],\"created_at\":\"2025-01-09T16:18:42.308Z\",\"created_by\":\"elastic\",\"description\":\"This is a sample endpoint type exception\",\"entries\":[{\"type\":\"exists\",\"field\":\"actingProcess.file.signer\",\"operator\":\"excluded\"},{\"type\":\"match_any\",\"field\":\"host.name\",\"value\":[\"some host\",\"another host\"],\"operator\":\"included\"}],\"id\":\"f37597ce-eaa7-4b64-9100-4301118f6806\",\"item_id\":\"simple_list_item\",\"list_id\":\"simple_list\",\"name\":\"Sample Endpoint Exception List\",\"namespace_type\":\"single\",\"os_types\":[\"linux\"],\"tags\":[\"user added string for a tag\",\"malware\"],\"tie_breaker_id\":\"4ca3ef3e-9721-42c0-8107-cf47e094d40f\",\"type\":\"simple\",\"updated_at\":\"2025-01-09T16:18:42.308Z\",\"updated_by\":\"elastic\"}\n{\"exported_exception_list_count\":1,\"exported_exception_list_item_count\":1,\"missing_exception_list_item_count\":0,\"missing_exception_list_items\":[],\"missing_exception_lists\":[],\"missing_exception_lists_count\":0}\n"
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: list_id: Required, namespace_type: Required'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/exception_lists/_export] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Exception list not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_find:
    get:
      tags:
        - Security Exceptions API
      summary: Get exception lists
      description: Get a list of all exception list containers.
      operationId: FindExceptionLists
      parameters:
        - name: filter
          in: query
          description: "Filters the returned results according to the value of the specified field.\n\nUses the `so type.field name:field` value syntax, where `so type` can be:\n\n- `exception-list`: Specify a space-aware exception list.\n- `exception-list-agnostic`: Specify an exception list that is shared across spaces.\n"
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_FindExceptionListsFilter'
        - name: namespace_type
          in: query
          description: "Determines whether the returned containers are Kibana associated with a Kibana space\nor available in all spaces (`agnostic` or `single`)\n"
          schema:
            type: array
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default:
              - single
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
        - name: page
          in: query
          description: The page number to return
          schema:
            minimum: 1
            type: integer
            example: 1
        - name: per_page
          in: query
          description: The number of exception lists to return per page
          schema:
            minimum: 1
            type: integer
            example: 20
        - name: sort_field
          in: query
          description: Determines which field is used to sort the results.
          schema:
            type: string
            example: name
        - name: sort_order
          in: query
          description: 'Determines the sort order, which can be `desc` or `asc`.'
          schema:
            enum:
              - desc
              - asc
            type: string
            example: desc
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - data
                  - page
                  - per_page
                  - total
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    minimum: 1
                    type: integer
                  total:
                    minimum: 0
                    type: integer
              examples:
                simpleLists:
                  value:
                    data:
                      - _version: WzIsMV0=
                        created_at: '2025-01-07T19:34:27.942Z'
                        created_by: elastic
                        description: This is a sample detection type exception list.
                        id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                        immutable: false
                        list_id: simple_list
                        name: Detection Exception List
                        namespace_type: single
                        os_types: [ ]
                        tags:
                          - malware
                        tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                        type: detection
                        updated_at: '2025-01-07T19:34:27.942Z'
                        updated_by: elastic
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/exception_lists/_find?namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/_import:
    post:
      tags:
        - Security Exceptions API
      summary: Import an exception list
      description: Import an exception list and its associated items from an NDJSON file.
      operationId: ImportExceptionList
      parameters:
        - name: overwrite
          in: query
          description: "Determines whether existing exception lists with the same `list_id` are overwritten.\nIf any exception items have the same `item_id`, those are also overwritten.\n"
          schema:
            type: boolean
            default: false
            example: false
        - name: as_new_list
          in: query
          description: "Determines whether the list being imported will have a new `list_id` generated.\nAdditional `item_id`'s are generated for each exception item. Both the exception\nlist and its items are overwritten.\n"
          schema:
            type: boolean
            default: false
            example: false
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  description: A `.ndjson` file containing the exception list
                  format: binary
                  example: "{\"_version\":\"WzExNDU5LDFd\",\"created_at\":\"2025-01-09T16:18:17.757Z\",\"created_by\":\"elastic\",\"description\":\"This is a sample detection type exception\",\"id\":\"c86c2da0-2ab6-4343-b81c-216ef27e8d75\",\"immutable\":false,\"list_id\":\"simple_list\",\"name\":\"Sample Detection Exception List\",\"namespace_type\":\"single\",\"os_types\":[],\"tags\":[\"user added string for a tag\",\"malware\"],\"tie_breaker_id\":\"cf4a7b92-732d-47f0-a0d5-49a35a1736bf\",\"type\":\"detection\",\"updated_at\":\"2025-01-09T16:18:17.757Z\",\"updated_by\":\"elastic\",\"version\":1}\n{\"_version\":\"WzExNDYxLDFd\",\"comments\":[],\"created_at\":\"2025-01-09T16:18:42.308Z\",\"created_by\":\"elastic\",\"description\":\"This is a sample endpoint type exception\",\"entries\":[{\"type\":\"exists\",\"field\":\"actingProcess.file.signer\",\"operator\":\"excluded\"},{\"type\":\"match_any\",\"field\":\"host.name\",\"value\":[\"some host\",\"another host\"],\"operator\":\"included\"}],\"id\":\"f37597ce-eaa7-4b64-9100-4301118f6806\",\"item_id\":\"simple_list_item\",\"list_id\":\"simple_list\",\"name\":\"Sample Endpoint Exception List\",\"namespace_type\":\"single\",\"os_types\":[\"linux\"],\"tags\":[\"user added string for a tag\",\"malware\"],\"tie_breaker_id\":\"4ca3ef3e-9721-42c0-8107-cf47e094d40f\",\"type\":\"simple\",\"updated_at\":\"2025-01-09T16:18:42.308Z\",\"updated_by\":\"elastic\"}\n"
            examples:
              ndjsonUpload:
                value:
                  file: exception_lists.ndjson
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - errors
                  - success
                  - success_count
                  - success_exception_lists
                  - success_count_exception_lists
                  - success_exception_list_items
                  - success_count_exception_list_items
                type: object
                properties:
                  errors:
                    $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkErrorArray'
                  success:
                    type: boolean
                  success_count:
                    minimum: 0
                    type: integer
                  success_count_exception_list_items:
                    minimum: 0
                    type: integer
                  success_count_exception_lists:
                    minimum: 0
                    type: integer
                  success_exception_list_items:
                    type: boolean
                  success_exception_lists:
                    type: boolean
              examples:
                withErrors:
                  value:
                    errors:
                      - error:
                          message: 'Error found importing exception list: Invalid value \"4\" supplied to \"list_id\"'
                          status_code: 400
                        list_id: (unknown list_id)
                      - error:
                          message: 'Found that item_id: \"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\" already exists. Import of item_id: \"f7fd00bb-dba8-4c93-9d59-6cbd427b6330\" skipped.'
                          status_code: 409
                        item_id: f7fd00bb-dba8-4c93-9d59-6cbd427b6330
                        list_id: 7d7cccb8-db72-4667-b1f3-648efad7c1ee
                    success: 'false,'
                    success_count: '0,'
                    success_count_exception_list_items: 0
                    success_count_exception_lists: '0,'
                    success_exception_list_items: 'false,'
                    success_exception_lists: 'false,'
                withoutErrors:
                  value:
                    errors: [ ]
                    success: true
                    success_count: 2
                    success_count_exception_list_items: 1
                    success_count_exception_lists: 1
                    success_exception_list_items: true
                    success_exception_lists: 'true,'
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: Multipart part `file` is required and must contain a valid .ndjson exception list export
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/exception_lists/_import] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/items:
    delete:
      tags:
        - Security Exceptions API
      summary: Delete an exception list item
      description: Delete an exception list item using the `id` or `item_id` field.
      operationId: DeleteExceptionListItem
      parameters:
        - name: id
          in: query
          description: Exception item's identifier. Either `id` or `item_id` must be specified
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        - name: item_id
          in: query
          description: 'Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified'
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        - name: namespace_type
          in: query
          description: "`single` deletes the item in the current Kibana space; `agnostic` deletes an item in a space-agnostic list. Must match the list that owns the item.\n"
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
              examples:
                simpleExceptionItem:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [DELETE /api/exception_lists/items?item_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Exception list item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Exceptions API
      summary: Get an exception list item
      description: Get the details of an exception list item using the `id` or `item_id` field.
      operationId: ReadExceptionListItem
      parameters:
        - name: id
          in: query
          description: Exception list item's identifier. Either `id` or `item_id` must be specified.
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        - name: item_id
          in: query
          description: 'Human readable exception item string identifier, e.g. `trusted-linux-processes`. Either `id` or `item_id` must be specified.'
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        - name: namespace_type
          in: query
          description: "`single` fetches the item in the current space; `agnostic` fetches a global (space-agnostic) item. Must\nmatch how the list was created.\n"
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
              examples:
                simpleListItem:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/exception_lists/items?item_id=&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: Exception list item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Exceptions API
      summary: Create an exception list item
      description: "Create an exception item and associate it with the specified exception list.\n> info\n> Before creating exception items, you must create an exception list.\n"
      operationId: CreateExceptionListItem
      requestBody:
        description: Exception list item's properties
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemGeneric'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemEndpointList'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedAppsLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindowsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemEventFilters'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemHostIsolation'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBlocklistMac'
            examples:
              simpleItem:
                value:
                  description: This is a sample detection type exception item.
                  entries:
                    - field: actingProcess.file.signer
                      operator: excluded
                      type: exists
                  item_id: simple_list_item
                  list_id: simple_list
                  name: Sample Exception List Item
                  namespace_type: single
                  os_types:
                    - linux
                  tags:
                    - malware
                  type: simple
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
              examples:
                autogeneratedItemId:
                  value:
                    _version: WzYsMV0=
                    comments: [ ]
                    created_at: '2025-01-09T01:16:23.322Z'
                    created_by: elastic
                    description: This is a sample exception that has no item_id so it is autogenerated.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                    id: 323faa75-c657-4fa0-9084-8827612c207b
                    item_id: 80e6edf7-4b13-4414-858f-2fa74aa52b37
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Sample Autogenerated Exception List Item ID
                    namespace_type: single
                    os_types: [ ]
                    tags:
                      - malware
                    tie_breaker_id: d6799986-3a23-4213-bc6d-ed9463a32f23
                    type: simple
                    updated_at: '2025-01-09T01:16:23.322Z'
                    updated_by: elastic
                detectionExceptionListItem:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withExistEntry:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: excluded
                        type: exists
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withMatchAnyEntry:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: host.name
                        operator: included
                        type: match_any
                        value:
                          - saturn
                          - jupiter
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withMatchEntry:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - field: actingProcess.file.signer
                        operator: included
                        type: match
                        value: Elastic N.V.
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withNestedEntry:
                  value:
                    _version: WzQsMV0=
                    comments: [ ]
                    created_at: '2025-01-07T20:07:33.119Z'
                    created_by: elastic
                    description: This is a sample detection type exception item.
                    entries:
                      - entries:
                          - field: signer
                            operator: included
                            type: match
                            value: Evil
                          - field: trusted
                            operator: included
                            type: match
                            value: true
                        field: file.signature
                        type: nested
                    id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Sample Exception List Item
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 09434836-9db9-4942-a234-5a9268e0b34c
                    type: simple
                    updated_at: '2025-01-07T20:07:33.119Z'
                    updated_by: elastic
                withValueListEntry:
                  value:
                    _version: WzcsMV0=
                    comments: [ ]
                    created_at: '2025-01-09T01:31:12.614Z'
                    created_by: elastic
                    description: Don't signal when agent.name is rock01 and source.ip is in the goodguys.txt list
                    entries:
                      - field: source.ip
                        list:
                          id: goodguys.txt
                          type: ip
                        operator: excluded
                        type: list
                    id: deb26876-297d-4677-8a1f-35467d2f1c4f
                    item_id: 686b129e-9b8d-4c59-8d8d-c93a9ea82c71
                    list_id: 8c1aae4c-1ef5-4bce-a2e3-16584b501783
                    name: Filter out good guys ip and agent.name rock01
                    namespace_type: single
                    os_types: [ ]
                    tags:
                      - malware
                    tie_breaker_id: 5e0288ce-6657-4c18-9dcc-00ec9e8cc6c8
                    type: simple
                    updated_at: '2025-01-09T01:31:12.614Z'
                    updated_by: elastic
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: 'Bad Request,'
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: '400,'
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '409':
          description: Exception list item already exists response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'exception list item id: \"simple_list_item\" already exists'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Exceptions API
      summary: Update an exception list item
      description: Update an exception list item using the `id` or `item_id` field.
      operationId: UpdateExceptionListItem
      requestBody:
        description: Exception list item's properties
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemGeneric'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemEndpointList'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedAppsLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindowsMac'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemEventFilters'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemHostIsolation'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistWindows'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistLinux'
                - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBlocklistMac'
            examples:
              updateItem:
                value:
                  description: Updated description
                  id: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
                  name: Updated name
                  namespace_type: single
                  type: simple
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
              examples:
                simpleListItem:
                  value:
                    _version: WzEyLDFd
                    comments: [ ]
                    created_at: '2025-01-07T21:12:25.512Z'
                    created_by: elastic
                    description: Updated description
                    entries:
                      - field: host.name
                        operator: included
                        type: match
                        value: rock01
                    id: 459c5e7e-f8b2-4f0b-b136-c1fc702f72da
                    item_id: simple_list_item
                    list_id: simple_list
                    name: Updated name
                    namespace_type: single
                    os_types: [ ]
                    tags: [ ]
                    tie_breaker_id: ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0
                    type: simple
                    updated_at: '2025-01-07T21:34:50.233Z'
                    updated_by: elastic
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: item_id: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PUT /api/exception_lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Exception list item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list item item_id: \"foo\" does not exist'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/items/_find:
    get:
      tags:
        - Security Exceptions API
      summary: Get exception list items
      description: Get a list of all exception list items in the specified list.
      operationId: FindExceptionListItems
      parameters:
        - name: list_id
          in: query
          description: The `list_id`s of the items to fetch.
          required: true
          schema:
            type: array
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - name: filter
          in: query
          description: "Filters the returned results according to the value of the specified field,\nusing the `<field name>:<field value>` syntax.\n"
          schema:
            type: array
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
            default: [ ]
          examples:
            singleFilter:
              value:
                - exception-list.attributes.name:%My%20item
        - name: namespace_type
          in: query
          description: "Determines whether the returned containers are Kibana associated with a Kibana space\nor available in all spaces (`agnostic` or `single`)\n"
          schema:
            type: array
            items:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
            default:
              - single
          examples:
            single:
              value:
                - single
        - name: search
          in: query
          description: "Free-text search term applied to exception list item fields (for example a hostname or file path fragment).\n"
          schema:
            type: string
            example: host.name
        - name: page
          in: query
          description: The page number to return
          schema:
            minimum: 0
            type: integer
            example: 1
        - name: per_page
          in: query
          description: The number of exception list items to return per page
          schema:
            minimum: 0
            type: integer
            example: 20
        - name: sort_field
          in: query
          description: Determines which field is used to sort the results.
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
          example: name
        - name: sort_order
          in: query
          description: 'Determines the sort order, which can be `desc` or `asc`.'
          schema:
            enum:
              - desc
              - asc
            type: string
            example: desc
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - data
                  - page
                  - per_page
                  - total
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItem'
                  page:
                    minimum: 1
                    type: integer
                  per_page:
                    minimum: 1
                    type: integer
                  pit:
                    type: string
                  total:
                    minimum: 0
                    type: integer
              examples:
                simpleListItems:
                  value:
                    data:
                      - _version: WzgsMV0=
                        comments: [ ]
                        created_at: '2025-01-07T21:12:25.512Z'
                        created_by: elastic
                        description: This is a sample exception item.
                        entries:
                          - field: actingProcess.file.signer
                            operator: excluded
                            type: exists
                          - field: host.name
                            operator: included
                            type: match_any
                            value:
                              - jupiter
                              - saturn
                        id: 459c5e7e-f8b2-4f0b-b136-c1fc702f72da
                        item_id: simple_list_item
                        list_id: simple_list
                        name: Sample Exception List Item
                        namespace_type: single
                        os_types:
                          - linux
                        tags:
                          - malware
                        tie_breaker_id: ad0754ff-7b19-49ca-b73e-e6aff6bfa2d0
                        type: simple
                        updated_at: '2025-01-07T21:12:25.512Z'
                        updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/exception_lists/items/_find?list_id=simple_list&namespace_type=single] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: Exception list not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'exception list list_id: "foo" does not exist'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exception_lists/summary:
    get:
      tags:
        - Security Exceptions API
      summary: Get an exception list summary
      description: Get a summary of the specified exception list.
      operationId: ReadExceptionListSummary
      parameters:
        - name: id
          in: query
          description: Exception list's identifier generated upon creation.
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        - name: list_id
          in: query
          description: Exception list's human readable identifier.
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        - name: namespace_type
          in: query
          description: "`single` returns summary for a list in the current space; `agnostic` for a space-agnostic list. Must\nline up with `id` / `list_id` used to look up the list.\n"
          schema:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
          examples:
            agnostic:
              value: agnostic
            single:
              value: single
        - name: filter
          in: query
          description: Search filter clause
          schema:
            type: string
            example: exception-list-agnostic.attributes.tags:"policy:policy-1" OR exception-list-agnostic.attributes.tags:"policy:all"
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  linux:
                    minimum: 0
                    type: integer
                  macos:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
                  windows:
                    minimum: 0
                    type: integer
              examples:
                summary:
                  value:
                    linux: 0
                    macos: 0
                    total: 0
                    windows: 0
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: namespace_type.0: Invalid enum value. Expected ''agnostic'' | ''single'', received ''blob'''
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/exception_lists/summary?list_id=simple_list&namespace_type=agnostic] is unauthorized for user, this action is granted by the Kibana privileges [lists-summary]'
                    statusCode: 403
        '404':
          description: Exception list not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message": 'exception list id: "foo" does not exist'
                    status_code": 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/exceptions/shared:
    post:
      tags:
        - Security Exceptions API
      summary: Create a shared exception list
      description: "An exception list groups exception items and can be associated with detection rules. A shared exception list can apply to multiple detection rules.\n> info\n> All exception items added to the same list are evaluated using `OR` logic. That is, if any of the items in a list evaluate to `true`, the exception prevents the rule from generating an alert. Likewise, `OR` logic is used for evaluating exceptions when more than one exception list is assigned to a rule. To use the `AND` operator, you can define multiple clauses (`entries`) in a single exception item.\n"
      operationId: CreateSharedExceptionList
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - description
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
                name:
                  $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
            examples:
              createSharedExceptionList:
                value:
                  description: This is a sample detection type exception list.
                  list_id: simple_list
                  name: Sample Detection Exception List
                  namespace_type: single
                  os_types:
                    - linux
                  tags:
                    - malware
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_ExceptionList'
              examples:
                sharedList:
                  value:
                    _version: WzIsMV0=
                    created_at: '2025-01-07T19:34:27.942Z'
                    created_by: elastic
                    description: This is a sample detection type exception list.
                    id: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
                    immutable: false
                    list_id: simple_list
                    name: Sample Detection Exception List
                    namespace_type: single
                    os_types:
                      - linux
                    tags:
                      - malware
                    tie_breaker_id: 78f1aca1-f8ee-4eb5-9ceb-f5c3ee656cb3
                    type: detection
                    updated_at: '2025-01-07T19:34:27.942Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: list_id: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    message: Unable to create exception-list
                    status_code: 403
        '409':
          description: Exception list already exists response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'exception list id: "simple_list" already exists'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Exceptions_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/features:
    get:
      tags:
        - system
      summary: Get features
      description: "Get information about all Kibana features. Features are used by spaces and security to refine and secure access to Kibana.\n"
      operationId: get-features
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                type: object
              examples:
                getFeaturesExample:
                  value: "{\n  \"features\": [\n    {\n      \"name\": \"tasks\",\n      \"description\": \"Manages task results\"\n    },\n    {\n      \"name\": \"security\",\n      \"description\": \"Manages configuration for Security features, such as users and roles\"\n    },\n    {\n      \"name\": \"searchable_snapshots\",\n      \"description\": \"Manages caches and configuration for searchable snapshots\"\n    },\n    {\n      \"name\": \"logstash_management\",\n      \"description\": \"Enables Logstash Central Management pipeline storage\"\n    },\n    {\n      \"name\": \"transform\",\n      \"description\": \"Manages configuration and state for transforms\"\n    },\n    {\n      \"name\": \"kibana\",\n      \"description\": \"Manages Kibana configuration and reports\"\n    },\n    {\n      \"name\": \"synonyms\",\n      \"description\": \"Manages synonyms\"\n    },\n    {\n      \"name\": \"async_search\",\n      \"description\": \"Manages results of async searches\"\n    },\n    {\n      \"name\": \"ent_search\",\n      \"description\": \"Manages configuration for Enterprise Search features\"\n    },\n    {\n      \"name\": \"machine_learning\",\n      \"description\": \"Provides anomaly detection and forecasting functionality\"\n    },\n    {\n      \"name\": \"geoip\",\n      \"description\": \"Manages data related to GeoIP database downloader\"\n    },\n    {\n      \"name\": \"watcher\",\n      \"description\": \"Manages Watch definitions and state\"\n    },\n    {\n      \"name\": \"fleet\",\n      \"description\": \"Manages configuration for Fleet\"\n    },\n    {\n      \"name\": \"enrich\",\n      \"description\": \"Manages data related to Enrich policies\"\n    },\n    {\n      \"name\": \"inference_plugin\",\n      \"description\": \"Inference plugin for managing inference services and inference\"\n    }\n  ]\n}\n"
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_download_sources:
    get:
      tags:
        - Elastic Agent binary download sources
      summary: Get agent binary download sources
      description: 'List all agent binary download sources.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.'
      operationId: get-fleet-agent-download-sources
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - name
                        - host
                      type: object
                      properties:
                        auth:
                          type:
                            - 'null'
                            - object
                          properties:
                            api_key:
                              type: string
                            headers:
                              maxItems: 100
                              type: array
                              items:
                                required:
                                  - key
                                  - value
                                type: object
                                properties:
                                  key:
                                    type: string
                                  value:
                                    type: string
                                additionalProperties: false
                            password:
                              type: string
                            username:
                              type: string
                          additionalProperties: false
                        host:
                          type: string
                          format: uri
                        id:
                          type: string
                        is_default:
                          type: boolean
                          default: false
                        is_preconfigured:
                          type: boolean
                        name:
                          type: string
                        proxy_id:
                          type:
                            - 'null'
                            - string
                          description: The ID of the proxy to use for this download source. See the proxies API for more information.
                        secrets:
                          type: object
                          properties:
                            auth:
                              type: object
                              properties:
                                api_key:
                                  anyOf:
                                    - required:
                                        - id
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      additionalProperties: false
                                    - type: string
                                password:
                                  anyOf:
                                    - required:
                                        - id
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      additionalProperties: false
                                    - type: string
                              additionalProperties: false
                            ssl:
                              type: object
                              properties:
                                key:
                                  anyOf:
                                    - required:
                                        - id
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      additionalProperties: false
                                    - type: string
                              additionalProperties: false
                          additionalProperties: false
                        ssl:
                          type: object
                          properties:
                            certificate:
                              type: string
                            certificate_authorities:
                              maxItems: 10
                              type: array
                              items:
                                type: string
                            key:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getDownloadSourcesExample:
                  description: List of agent binary download sources
                  value:
                    items:
                      - host: https://artifacts.elastic.co/downloads/
                        id: download-source-id-1
                        is_default: true
                        name: Elastic Artifacts
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Agent binary download sources
      summary: Create an agent binary download source
      description: 'Create a new agent binary download source.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: post-fleet-agent-download-sources
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - host
              type: object
              properties:
                auth:
                  type:
                    - 'null'
                    - object
                  properties:
                    api_key:
                      type: string
                    headers:
                      maxItems: 100
                      type: array
                      items:
                        required:
                          - key
                          - value
                        type: object
                        properties:
                          key:
                            type: string
                          value:
                            type: string
                        additionalProperties: false
                    password:
                      type: string
                    username:
                      type: string
                  additionalProperties: false
                host:
                  type: string
                  format: uri
                id:
                  type: string
                is_default:
                  type: boolean
                  default: false
                name:
                  type: string
                proxy_id:
                  type:
                    - 'null'
                    - string
                  description: The ID of the proxy to use for this download source. See the proxies API for more information.
                secrets:
                  type: object
                  properties:
                    auth:
                      type: object
                      properties:
                        api_key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        password:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                    ssl:
                      type: object
                      properties:
                        key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                  additionalProperties: false
                ssl:
                  type: object
                  properties:
                    certificate:
                      type: string
                    certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    key:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            examples:
              postDownloadSourceRequestExample:
                description: Create a new agent binary download source
                value:
                  host: https://my-custom-host.example.com/downloads/
                  is_default: false
                  name: My custom download source
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - name
                      - host
                    type: object
                    properties:
                      auth:
                        type:
                          - 'null'
                          - object
                        properties:
                          api_key:
                            type: string
                          headers:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - key
                                - value
                              type: object
                              properties:
                                key:
                                  type: string
                                value:
                                  type: string
                              additionalProperties: false
                          password:
                            type: string
                          username:
                            type: string
                        additionalProperties: false
                      host:
                        type: string
                        format: uri
                      id:
                        type: string
                      is_default:
                        type: boolean
                        default: false
                      is_preconfigured:
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        type:
                          - 'null'
                          - string
                        description: The ID of the proxy to use for this download source. See the proxies API for more information.
                      secrets:
                        type: object
                        properties:
                          auth:
                            type: object
                            properties:
                              api_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              password:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                          ssl:
                            type: object
                            properties:
                              key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                        additionalProperties: false
                      ssl:
                        type: object
                        properties:
                          certificate:
                            type: string
                          certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          key:
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                postDownloadSourceExample:
                  description: The created agent binary download source
                  value:
                    item:
                      host: https://my-custom-host.example.com/downloads/
                      id: download-source-id-2
                      is_default: false
                      name: My custom download source
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_download_sources/{sourceId}':
    delete:
      tags:
        - Elastic Agent binary download sources
      summary: Delete an agent binary download source
      description: 'Delete an agent binary download source by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: delete-fleet-agent-download-sources-sourceid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: sourceId
          in: path
          description: The ID of the download source
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteDownloadSourceExample:
                  description: The download source was successfully deleted
                  value:
                    id: download-source-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No download source was found with the given ID
                  value:
                    error: Not Found
                    message: Agent binary source download-source-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Elastic Agent binary download sources
      summary: Get an agent binary download source
      description: 'Get an agent binary download source by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-settings-read.'
      operationId: get-fleet-agent-download-sources-sourceid
      parameters:
        - name: sourceId
          in: path
          description: The ID of the download source
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - name
                      - host
                    type: object
                    properties:
                      auth:
                        type:
                          - 'null'
                          - object
                        properties:
                          api_key:
                            type: string
                          headers:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - key
                                - value
                              type: object
                              properties:
                                key:
                                  type: string
                                value:
                                  type: string
                              additionalProperties: false
                          password:
                            type: string
                          username:
                            type: string
                        additionalProperties: false
                      host:
                        type: string
                        format: uri
                      id:
                        type: string
                      is_default:
                        type: boolean
                        default: false
                      is_preconfigured:
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        type:
                          - 'null'
                          - string
                        description: The ID of the proxy to use for this download source. See the proxies API for more information.
                      secrets:
                        type: object
                        properties:
                          auth:
                            type: object
                            properties:
                              api_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              password:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                          ssl:
                            type: object
                            properties:
                              key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                        additionalProperties: false
                      ssl:
                        type: object
                        properties:
                          certificate:
                            type: string
                          certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          key:
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                getDownloadSourceExample:
                  description: An agent binary download source
                  value:
                    item:
                      host: https://artifacts.elastic.co/downloads/
                      id: download-source-id-1
                      is_default: true
                      name: Elastic Artifacts
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No download source was found with the given ID
                  value:
                    error: Not Found
                    message: Agent binary source download-source-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Elastic Agent binary download sources
      summary: Update an agent binary download source
      description: 'Update an agent binary download source by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: put-fleet-agent-download-sources-sourceid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: sourceId
          in: path
          description: The ID of the download source
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - host
              type: object
              properties:
                auth:
                  type:
                    - 'null'
                    - object
                  properties:
                    api_key:
                      type: string
                    headers:
                      maxItems: 100
                      type: array
                      items:
                        required:
                          - key
                          - value
                        type: object
                        properties:
                          key:
                            type: string
                          value:
                            type: string
                        additionalProperties: false
                    password:
                      type: string
                    username:
                      type: string
                  additionalProperties: false
                host:
                  type: string
                  format: uri
                id:
                  type: string
                is_default:
                  type: boolean
                  default: false
                name:
                  type: string
                proxy_id:
                  type:
                    - 'null'
                    - string
                  description: The ID of the proxy to use for this download source. See the proxies API for more information.
                secrets:
                  type: object
                  properties:
                    auth:
                      type: object
                      properties:
                        api_key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        password:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                    ssl:
                      type: object
                      properties:
                        key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                  additionalProperties: false
                ssl:
                  type: object
                  properties:
                    certificate:
                      type: string
                    certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    key:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            examples:
              putDownloadSourceRequestExample:
                description: Update an agent binary download source
                value:
                  host: https://updated-host.example.com/downloads/
                  is_default: false
                  name: Updated download source
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - name
                      - host
                    type: object
                    properties:
                      auth:
                        type:
                          - 'null'
                          - object
                        properties:
                          api_key:
                            type: string
                          headers:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - key
                                - value
                              type: object
                              properties:
                                key:
                                  type: string
                                value:
                                  type: string
                              additionalProperties: false
                          password:
                            type: string
                          username:
                            type: string
                        additionalProperties: false
                      host:
                        type: string
                        format: uri
                      id:
                        type: string
                      is_default:
                        type: boolean
                        default: false
                      is_preconfigured:
                        type: boolean
                      name:
                        type: string
                      proxy_id:
                        type:
                          - 'null'
                          - string
                        description: The ID of the proxy to use for this download source. See the proxies API for more information.
                      secrets:
                        type: object
                        properties:
                          auth:
                            type: object
                            properties:
                              api_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              password:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                          ssl:
                            type: object
                            properties:
                              key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                        additionalProperties: false
                      ssl:
                        type: object
                        properties:
                          certificate:
                            type: string
                          certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          key:
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                putDownloadSourceExample:
                  description: The updated agent binary download source
                  value:
                    item:
                      host: https://updated-host.example.com/downloads/
                      id: download-source-id-1
                      is_default: false
                      name: Updated download source
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No download source was found with the given ID
                  value:
                    error: Not Found
                    message: Download source download-source-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies:
    get:
      tags:
        - Elastic Agent policies
      summary: Get agent policies
      description: 'List all agent policies.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
      operationId: get-fleet-agent-policies
      parameters:
        - name: page
          in: query
          description: Page number
          schema:
            type: number
        - name: perPage
          in: query
          description: Number of results per page
          schema:
            type: number
        - name: sortField
          in: query
          description: Field to sort results by
          schema:
            type: string
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending'
          schema:
            enum:
              - desc
              - asc
            type: string
        - name: showUpgradeable
          in: query
          description: 'When true, only show policies with upgradeable agents'
          schema:
            type: boolean
        - name: kuery
          in: query
          description: A KQL query string to filter results
          schema:
            type: string
        - name: noAgentCount
          in: query
          description: use withAgentCount instead
          schema:
            type: boolean
            deprecated: true
        - name: withAgentCount
          in: query
          description: get policies with agent count
          schema:
            type: boolean
        - name: full
          in: query
          description: get full policies with package policies populated
          schema:
            type: boolean
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_agent_policy_response'
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getAgentPoliciesExample:
                  description: List of agent policies
                  value:
                    items:
                      - description: A sample agent policy
                        id: agent-policy-id-1
                        is_managed: false
                        is_protected: false
                        name: My agent policy
                        namespace: default
                        revision: 1
                        status: active
                        updated_at: '2024-01-15T10:00:00.000Z'
                        updated_by: user1
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Agent policies
      summary: Create an agent policy
      description: 'Create a new agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.'
      operationId: post-fleet-agent-policies
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: sys_monitoring
          in: query
          description: Whether to add the system integration to the new agent policy
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_agent_policy'
            examples:
              postAgentPolicyRequestExample:
                description: Create a new agent policy
                value:
                  description: A sample agent policy
                  monitoring_enabled:
                    - logs
                    - metrics
                  name: My agent policy
                  namespace: default
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
              examples:
                postAgentPolicyExample:
                  description: The created agent policy
                  value:
                    item:
                      description: A sample agent policy
                      id: agent-policy-id-2
                      is_managed: false
                      is_protected: false
                      name: My agent policy
                      namespace: default
                      revision: 1
                      status: active
                      updated_at: '2024-01-15T10:00:00.000Z'
                      updated_by: user1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/_bulk_get:
    post:
      tags:
        - Elastic Agent policies
      summary: Bulk get agent policies
      description: 'Get multiple agent policies by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
      operationId: post-fleet-agent-policies-bulk-get
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ids
              type: object
              properties:
                full:
                  type: boolean
                  description: get full policies with package policies populated
                ids:
                  maxItems: 1000
                  type: array
                  items:
                    type: string
                  description: list of package policy ids
                ignoreMissing:
                  type: boolean
              additionalProperties: false
            examples:
              postBulkGetAgentPoliciesRequestExample:
                description: Retrieve multiple agent policies by ID
                value:
                  ids:
                    - agent-policy-id-1
                    - agent-policy-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_get_agent_policies_response'
              examples:
                postBulkGetAgentPoliciesExample:
                  description: The requested agent policies
                  value:
                    items:
                      - id: agent-policy-id-1
                        is_managed: false
                        is_protected: false
                        name: My agent policy
                        namespace: default
                        revision: 1
                        status: active
                        updated_at: '2024-01-15T10:00:00.000Z'
                        updated_by: user1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: One or more agent policies were not found
                  value:
                    error: Not Found
                    message: An error message describing what went wrong
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_policies/{agentPolicyId}':
    get:
      tags:
        - Elastic Agent policies
      summary: Get an agent policy
      description: 'Get an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-agents-read OR fleet-setup.'
      operationId: get-fleet-agent-policies-agentpolicyid
      parameters:
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
              examples:
                getAgentPolicyExample:
                  description: An agent policy
                  value:
                    item:
                      description: A sample agent policy
                      id: agent-policy-id-1
                      is_managed: false
                      is_protected: false
                      name: My agent policy
                      namespace: default
                      revision: 1
                      status: active
                      updated_at: '2024-01-15T10:00:00.000Z'
                      updated_by: user1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Elastic Agent policies
      summary: Update an agent policy
      description: 'Update an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.'
      operationId: put-fleet-agent-policies-agentpolicyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_agent_policy_request_body'
            examples:
              putAgentPolicyRequestExample:
                description: Update an agent policy
                value:
                  description: An updated agent policy description
                  monitoring_enabled:
                    - logs
                  name: Updated agent policy
                  namespace: default
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
              examples:
                putAgentPolicyExample:
                  description: The updated agent policy
                  value:
                    item:
                      description: An updated agent policy description
                      id: agent-policy-id-1
                      is_managed: false
                      is_protected: false
                      name: Updated agent policy
                      namespace: default
                      revision: 2
                      status: active
                      updated_at: '2024-01-15T11:00:00.000Z'
                      updated_by: user1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_policies/{agentPolicyId}/auto_upgrade_agents_status':
    get:
      tags:
        - Elastic Agent policies
      summary: Get auto upgrade agent status
      description: 'Get the auto-upgrade status for agents assigned to an agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agent-policies-agentpolicyid-auto-upgrade-agents-status
      parameters:
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - currentVersions
                  - totalAgents
                type: object
                properties:
                  currentVersions:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - version
                        - agents
                        - failedUpgradeAgents
                        - inProgressUpgradeAgents
                      type: object
                      properties:
                        agents:
                          type: number
                          description: Number of agents that upgraded to this version
                        failedUpgradeActionIds:
                          maxItems: 1000
                          type: array
                          items:
                            type: string
                          description: List of action IDs related to failed upgrades
                        failedUpgradeAgents:
                          type: number
                          description: Number of agents that failed to upgrade to this version
                        inProgressUpgradeActionIds:
                          maxItems: 1000
                          type: array
                          items:
                            type: string
                          description: List of action IDs related to in-progress upgrades
                        inProgressUpgradeAgents:
                          type: number
                          description: Number of agents that are upgrading to this version
                        version:
                          type: string
                          description: Agent version
                      additionalProperties: false
                  totalAgents:
                    type: number
                additionalProperties: false
              examples:
                getAutoUpgradeAgentsStatusExample:
                  description: Auto-upgrade status for agents in the policy
                  value:
                    agentsCount: 5
                    currentVersion: '8.16.0'
                    failedAgentsCount: 0
                    upgradedAgentsCount: 3
                    upgradingAgentsCount: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_policies/{agentPolicyId}/copy':
    post:
      tags:
        - Elastic Agent policies
      summary: Copy an agent policy
      description: 'Copy an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.'
      operationId: post-fleet-agent-policies-agentpolicyid-copy
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_copy_agent_policy_request'
            examples:
              postCopyAgentPolicyRequestExample:
                description: Copy an agent policy with a new name
                value:
                  description: A copy of the original agent policy
                  name: Copy of my agent policy
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_response'
              examples:
                postCopyAgentPolicyExample:
                  description: The copied agent policy
                  value:
                    item:
                      description: A copy of the original agent policy
                      id: agent-policy-id-copy-1
                      is_managed: false
                      is_protected: false
                      name: Copy of my agent policy
                      namespace: default
                      revision: 1
                      status: active
                      updated_at: '2024-01-15T11:00:00.000Z'
                      updated_by: user1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_policies/{agentPolicyId}/download':
    get:
      tags:
        - Elastic Agent policies
      summary: Download an agent policy
      description: 'Download an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.'
      operationId: get-fleet-agent-policies-agentpolicyid-download
      parameters:
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
        - name: download
          in: query
          description: 'If true, returns the policy as a downloadable file'
          schema:
            type: boolean
        - name: standalone
          in: query
          description: 'If true, returns the policy formatted for standalone agents'
          schema:
            type: boolean
        - name: kubernetes
          in: query
          description: 'If true, returns the policy formatted for Kubernetes deployment'
          schema:
            type: boolean
        - name: revision
          in: query
          description: 'If provided, returns the policy at the specified revision. Cannot be used with standalone or kubernetes flags.'
          schema:
            type: number
      responses:
        '200':
          description: Successful response — returns the agent policy as a YAML file download
          content:
            application/json:
              schema:
                type: string
              examples:
                getDownloadAgentPolicyExample:
                  description: The agent policy download response
                  value:
                    item: 'id: agent-policy-id-1\nrevision: 1\noutputs:\n  default:\n    type: elasticsearch\n    hosts:\n      - https://elasticsearch.example.com:9200\n'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_policies/{agentPolicyId}/full':
    get:
      tags:
        - Elastic Agent policies
      summary: Get a full agent policy
      description: 'Get a full agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read.'
      operationId: get-fleet-agent-policies-agentpolicyid-full
      parameters:
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
        - name: download
          in: query
          description: 'If true, returns the policy as a downloadable file'
          schema:
            type: boolean
        - name: standalone
          in: query
          description: 'If true, returns the policy formatted for standalone agents'
          schema:
            type: boolean
        - name: kubernetes
          in: query
          description: 'If true, returns the policy formatted for Kubernetes deployment'
          schema:
            type: boolean
        - name: revision
          in: query
          description: 'If provided, returns the policy at the specified revision. Cannot be used with standalone or kubernetes flags.'
          schema:
            type: number
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_full_agent_policy_response'
              examples:
                getFullAgentPolicyExample:
                  description: The full agent policy configuration
                  value:
                    item:
                      agent:
                        monitoring:
                          logs: true
                          metrics: true
                      id: agent-policy-id-1
                      inputs: [ ]
                      outputs:
                        default:
                          hosts:
                            - https://elasticsearch.example.com:9200
                          type: elasticsearch
                      revision: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agent_policies/{agentPolicyId}/outputs':
    get:
      tags:
        - Elastic Agent policies
      summary: Get outputs for an agent policy
      description: 'Get a list of outputs associated with agent policy by policy id.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.'
      operationId: get-fleet-agent-policies-agentpolicyid-outputs
      parameters:
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_agent_policy_outputs_response'
              examples:
                getAgentPolicyOutputsExample:
                  description: Outputs associated with the agent policy
                  value:
                    item:
                      data_output:
                        id: output-id-1
                        name: Default output
                        type: elasticsearch
                      monitoring_output:
                        id: output-id-1
                        name: Default output
                        type: elasticsearch
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/delete:
    post:
      tags:
        - Elastic Agent policies
      summary: Delete an agent policy
      description: 'Delete an agent policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all.'
      operationId: post-fleet-agent-policies-delete
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_agent_policy_request'
            examples:
              postDeleteAgentPolicyRequestExample:
                description: Delete an agent policy by ID
                value:
                  agentPolicyId: agent-policy-id-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_agent_policy_response'
              examples:
                postDeleteAgentPolicyExample:
                  description: The agent policy was successfully deleted
                  value:
                    id: agent-policy-id-1
                    name: My agent policy
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_policies/outputs:
    post:
      tags:
        - Elastic Agent policies
      summary: Get outputs for agent policies
      description: 'Get a list of outputs associated with agent policies.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read AND fleet-settings-read.'
      operationId: post-fleet-agent-policies-outputs
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_get_list_agent_policy_outputs_request'
            examples:
              postListAgentPolicyOutputsRequestExample:
                description: Get outputs for multiple agent policies
                value:
                  ids:
                    - agent-policy-id-1
                    - agent-policy-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_list_agent_policy_outputs_response'
              examples:
                postListAgentPolicyOutputsExample:
                  description: Outputs associated with the requested agent policies
                  value:
                    items:
                      - agent_policy_id: agent-policy-id-1
                        data_output:
                          id: output-id-1
                          name: Default output
                          type: elasticsearch
                        monitoring_output:
                          id: output-id-1
                          name: Default output
                          type: elasticsearch
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_status:
    get:
      tags:
        - Elastic Agent status
      summary: Get an agent status summary
      description: Get a summary of agent statuses for a given agent policy.
      operationId: get-fleet-agent-status
      parameters:
        - name: policyId
          in: query
          description: Filter by agent policy ID
          schema:
            type: string
        - name: policyIds
          in: query
          description: Filter by one or more agent policy IDs
          schema:
            maxItems: 1000
            type: array
            items:
              type: string
        - name: kuery
          in: query
          description: A KQL query string to filter results
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - results
                type: object
                properties:
                  results:
                    required:
                      - events
                      - online
                      - error
                      - offline
                      - other
                      - updating
                      - inactive
                      - unenrolled
                      - all
                      - active
                    type: object
                    properties:
                      active:
                        type: number
                      all:
                        type: number
                      error:
                        type: number
                      events:
                        type: number
                      inactive:
                        type: number
                      offline:
                        type: number
                      online:
                        type: number
                      orphaned:
                        type: number
                      other:
                        type: number
                      unenrolled:
                        type: number
                      uninstalled:
                        type: number
                      updating:
                        type: number
                    additionalProperties: false
                additionalProperties: false
              examples:
                getAgentStatusExample:
                  description: Agent status summary for an agent policy
                  value:
                    results:
                      error: 1
                      offline: 2
                      online: 5
                      other: 0
                      updating: 0
                    totalInactive: 0
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agent_status/data:
    get:
      tags:
        - Elastic Agents
      summary: Get incoming agent data
      description: 'Get the data streams that an agent is actively sending data to.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agent-status-data
      parameters:
        - name: agentsIds
          in: query
          description: 'Agent IDs to check data for, as an array or comma-separated string'
          required: true
          schema:
            maxItems: 10000
            type: array
            items:
              type: string
        - name: pkgName
          in: query
          description: Filter by integration package name
          schema:
            type: string
        - name: pkgVersion
          in: query
          description: Filter by integration package version
          schema:
            type: string
        - name: previewData
          in: query
          description: 'When true, return a preview of the ingested data'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - dataPreview
                type: object
                properties:
                  dataPreview:
                    maxItems: 10000
                    type: array
                    items: { }
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      type: object
                      additionalProperties:
                        required:
                          - data
                        type: object
                        properties:
                          data:
                            type: boolean
                        additionalProperties: false
                additionalProperties: false
              examples:
                getAgentDataExample:
                  description: Data streams the agent is actively sending data to
                  value:
                    items:
                      - data:
                          logs-nginx.access-default:
                            - id: agent-id-1
                              name: my-host
                    total: 1
                    totalMonitoring: 0
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies:
    get:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Get managed integrations'
      description: Deprecated. Use `GET /api/fleet/managed_integrations` instead. List managed integrations
      operationId: get-fleet-agentless-policies
      parameters:
        - name: page
          in: query
          description: Page number. Defaults to `1`.
          schema:
            type: number
        - name: perPage
          in: query
          description: Number of results per page. Defaults to `20`.
          schema:
            type: number
        - name: sortField
          in: query
          description: Field to sort results by. Defaults to `updated_at`.
          schema:
            maxLength: 256
            type: string
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending. Defaults to `desc`.'
          schema:
            enum:
              - desc
              - asc
            type: string
        - name: kuery
          in: query
          description: 'A KQL query string to filter results. Filtering is restricted to the following fields: `name`, `namespace`, `package.name`.'
          schema:
            maxLength: 4096
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                listManagedIntegrationsResponseExample:
                  description: Example response for listing managed integrations
                  value:
                    items:
                      - created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            streams:
                              ess_billing.billing:
                                enabled: true
                              ess_billing.credits:
                                enabled: false
                            vars:
                              api_key:
                                id: QY1sWpoBbWcMW-edr0Ee
                                isSecretRef: true
                              organization_id: '1234'
                              url: https://billing.elastic-cloud.com
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: '1.6.0'
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      - cloud_connector:
                          cloud_connector_id: aws-connector-67890
                          enabled: true
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: CSPM integration for AWS with cloud connector
                        id: aws-policy-12345
                        inputs:
                          cspm-cloudbeat/cis_aws:
                            enabled: true
                        name: cspm-aws-policy
                        namespace: default
                        package:
                          name: cloud_security_posture
                          title: Cloud Security Posture Management
                          version: '3.1.1'
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                        vars:
                          deployment: aws
                          posture: cspm
                    page: 1
                    perPage: 20
                    total: 2
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Create a managed integration'
      description: Deprecated. Use `POST /api/fleet/managed_integrations` instead. Create a managed integration
      operationId: post-fleet-agentless-policies
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
            examples:
              createManagedIntegrationsRequestExample:
                description: Example request to create a managed integration
                value:
                  description: test
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 365
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.6.0'
              createManagedIntegrationsReuseAWSCloudConnectorExample:
                description: Example request to create a managed integration reusing an existing AWS cloud connector
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-reuse-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAWSCloudConnectorExample:
                description: Example request to create a managed integration with AWS cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAzureCloudConnectorExample:
                description: Example request to create a managed integration with Azure cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: azure
                  description: CSPM integration for Azure with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: false
                    cspm-cloudbeat/cis_azure:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            azure_credentials_cloud_connector_id:
                              type: text
                              value: existing-azure-credentials-connector-id
                            azure.account_type: organization-account
                            client_id:
                              id: client-secret-id
                              isSecretRef: true
                            tenant_id:
                              id: tenant-secret-id
                              isSecretRef: true
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-azure-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: azure
                    posture: cspm
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
              examples:
                createManagedIntegrationsResponseExample:
                  description: Example response for creating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: '1.6.0'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                createManagedIntegrationsWithAWSCloudConnectorResponseExample:
                  description: Example response for AWS cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: '3.1.1'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
                createManagedIntegrationsWithAzureCloudConnectorResponseExample:
                  description: Example response for Azure cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: azure-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for Azure with cloud connector
                      id: azure-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: false
                        cspm-cloudbeat/cis_azure:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                azure_credentials_cloud_connector_id:
                                  type: text
                                  value: existing-azure-credentials-connector-id
                                azure.account_type: organization-account
                                client_id:
                                  id: client-secret-id-456
                                  isSecretRef: true
                                tenant_id:
                                  id: tenant-secret-id-123
                                  isSecretRef: true
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-azure-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: '3.1.1'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: azure
                        posture: cspm
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies/_upgrade:
    post:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Bulk upgrade managed integrations'
      description: 'Deprecated. Use `POST /api/fleet/managed_integrations/_upgrade` instead. Upgrade multiple managed integrations to their installed package version, migrating each package policy''s config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy''s saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.'
      operationId: post-fleet-agentless-policies-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request'
            examples:
              upgradeManagedIntegrationsRequestExample:
                description: Bulk upgrade managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
                    - aws-policy-12345
      responses:
        '200':
          description: 'Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item''s `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch.'
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result'
              examples:
                upgradeManagedIntegrationsPartialFailureResponseExample:
                  description: Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - body:
                        message: Agentless policy aws-policy-12345 not found
                      id: aws-policy-12345
                      statusCode: 404
                      success: false
                upgradeManagedIntegrationsResponseExample:
                  description: Example response where every policy was upgraded
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - id: aws-policy-12345
                      name: cspm-aws-policy
                      success: true
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agentless_policies/_upgrade/dryrun:
    post:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Preview a managed integrations upgrade'
      description: 'Deprecated. Use `POST /api/fleet/managed_integrations/_upgrade/dryrun` instead. Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. Each result returns the current/proposed version and any migration errors, plus — only on a clean dry-run (`hasErrors: false`) — the migrated `proposedPolicy`. `proposedPolicy` is for the edit-and-upgrade flow (edit it, then save via the update (PUT) endpoint); to apply an upgrade as-is, use `_upgrade`.'
      operationId: post-fleet-agentless-policies-upgrade-dryrun
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request'
            examples:
              upgradeManagedIntegrationsDryRunRequestExample:
                description: Preview the upgrade of managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
              upgradeManagedIntegrationsDryRunTargetVersionRequestExample:
                description: 'Preview the upgrade against an explicit target package version (for example, before installing the new version). Defaults to the installed package version when omitted.'
                value:
                  pkgVersion: '1.6.0'
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
      responses:
        '200':
          description: 'Indicates a successful response. Each clean item (`hasErrors: false`) previews the migrated policy as a consumable managed integration (`proposedPolicy`); a missing id, an id that is not a managed integration, or a migration error, is reported as a per-item failure (`hasErrors: true`, with `proposedPolicy` omitted) without failing the batch. Inspect every item.'
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_result'
              examples:
                upgradeManagedIntegrationsDryRunMigrationErrorsExample:
                  description: Example dry-run response where migrating the config to the new version produced errors. `hasErrors` is true and `errors` explains why; do not feed the (partial) proposed config into the update endpoint without resolving them.
                  value:
                    - currentVersion: '1.5.0'
                      errors:
                        - message: Variable "organization_id" is required
                      hasErrors: true
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedVersion: '1.6.0'
                upgradeManagedIntegrationsDryRunMixedResponseExample:
                  description: 'Example dry-run response for a mixed batch: one managed integration previews cleanly while two ids are missing or not managed integrations. Ids that are missing or not managed integrations are surfaced as per-item failures (`hasErrors: true` + `statusCode`) without failing the batch, and results stay in request order.'
                  value:
                    - currentVersion: 0.5.0
                      hasErrors: false
                      id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                      name: agentless_hello_world-16
                      proposedPolicy:
                        cloud_connector: 'null'
                        created_at: '2026-07-01T15:59:08.299Z'
                        created_by: admin
                        description: ''
                        id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                        inputs:
                          agentless_hello_world-cel:
                            enabled: true
                            streams:
                              agentless_hello_world.generic:
                                enabled: true
                                vars:
                                  url: https://epr.elastic.co
                              agentless_hello_world.mock_counter:
                                enabled: false
                                vars:
                                  events_per_second: 10
                                  mode: constant
                                  spike_events: 100
                                  spike_every_seconds: 60
                          agentless_hello_world-httpjson:
                            enabled: false
                            streams:
                              agentless_hello_world.generic:
                                enabled: false
                                vars:
                                  url: https://epr.elastic.co
                        name: agentless_hello_world-16
                        namespace: default
                        package:
                          name: agentless_hello_world
                          title: Agentless Hello World
                          version: 0.5.0
                        updated_at: '2026-07-01T16:02:14.067Z'
                        updated_by: admin
                      proposedVersion: 0.5.0
                    - body:
                        message: Agentless policy 9300464c-6cfc-4566-850d-e9e7927457fe not found
                      hasErrors: true
                      id: 9300464c-6cfc-4566-850d-e9e7927457fe
                      statusCode: 404
                    - body:
                        message: Agentless policy 5b8763e9-791a-4038-be29-b384d578200e not found
                      hasErrors: true
                      id: 5b8763e9-791a-4038-be29-b384d578200e
                      statusCode: 404
                upgradeManagedIntegrationsDryRunResponseExample:
                  description: 'Example clean dry-run response (`hasErrors: false`) with the proposed (migrated) policy. `proposedPolicy` is intended for the edit-and-upgrade flow: edit it and submit the edited payload to the update (PUT) endpoint. To apply without edits, use the `_upgrade` endpoint instead.'
                  value:
                    - currentVersion: '1.5.0'
                      hasErrors: false
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedPolicy:
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            vars:
                              organization_id: '1234'
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: '1.6.0'
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      proposedVersion: '1.6.0'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agentless_policies/{policyId}':
    delete:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Delete a managed integration'
      description: 'Deprecated. Use `DELETE /api/fleet/managed_integrations/{policyId}` instead. Delete a managed integration'
      operationId: delete-fleet-agentless-policies-policyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: policyId
          in: path
          description: The ID of the policy to delete.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: force
          in: query
          description: Force delete the policy even if the policy is managed.
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the deleted managed integration.
                additionalProperties: false
                description: Response for deleting a managed integration.
              examples:
                deleteManagedIntegrationsResponseExample:
                  description: Example response for deleting a managed integration
                  value:
                    item:
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Get a managed integration'
      description: 'Deprecated. Use `GET /api/fleet/managed_integrations/{policyId}` instead. Get a managed integration by ID'
      operationId: get-fleet-agentless-policies-policyid
      parameters:
        - name: policyId
          in: path
          description: The ID of the managed integration to retrieve.
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
              examples:
                getManagedIntegrationResponseExample:
                  description: Example response for getting a managed integration by ID
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: '1.6.0'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet agentless policies
      summary: 'Deprecated: Update a managed integration'
      description: 'Deprecated. Use `PUT /api/fleet/managed_integrations/{policyId}` instead. Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is cleared or reset to its default. The integration package name is immutable and the runtime-managed `cluster_id` is preserved from the existing policy.'
      operationId: put-fleet-agentless-policies-policyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: policyId
          in: path
          description: The ID of the managed integration to update.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
            examples:
              updateManagedIntegrationAttachAWSCloudConnectorRequestExample:
                description: 'Example request to attach an AWS cloud connector to a managed integration on update. Because `PUT` is full-replace, the `cloud_connector` block must be present on every subsequent update or the connector is detached.'
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationClearFieldsRequestExample:
                description: 'Example showing full-replace clearing semantics. Compared to the prior state, this request omits `description` (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is dropped from the resulting policy.'
                value:
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.6.0'
              updateManagedIntegrationRequestExample:
                description: 'Example request to update a managed integration. `PUT` uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting `description` clears it, omitting `vars` or `global_data_tags` removes them, and omitting `cloud_connector` detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using `PUT`: the integration `package.name` is immutable, and the runtime-managed `cluster_id` is preserved from the existing agent policy.'
                value:
                  description: updated description
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 180
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.6.0'
              updateManagedIntegrationReuseAWSCloudConnectorRequestExample:
                description: Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one.
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationVersionChangeRequestExample:
                description: 'Example request to update a managed integration to a different package version. The package name is immutable, but the version may change.'
                value:
                  description: bumped to a newer package version
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.7.0'
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
              examples:
                updateManagedIntegrationResponseExample:
                  description: Example response for updating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: updated description
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 180
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: true
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: '1.6.0'
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                updateManagedIntegrationWithAWSCloudConnectorResponseExample:
                  description: Example response after attaching an AWS cloud connector on update
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: '3.1.1'
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
                packageNameChangeErrorResponseExample:
                  description: The integration package name cannot be changed on update
                  value:
                    error: Bad Request
                    message: Cannot change the integration package of an agentless policy (from "ess_billing" to "cloud_security_posture").
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
        '409':
          description: 'Conflict — for example, the requested name is already used by another integration policy.'
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictErrorResponseExample:
                  description: Example of a name-conflict error response
                  value:
                    error: Conflict
                    message: An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.
                    statusCode: 409
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents:
    get:
      tags:
        - Elastic Agents
      summary: Get agents
      description: 'List agents, with optional filtering and pagination.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents
      parameters:
        - name: page
          in: query
          description: Page number
          schema:
            type: number
        - name: perPage
          in: query
          description: Number of results per page
          schema:
            type: number
            default: 20
        - name: kuery
          in: query
          description: A KQL query string to filter results
          schema:
            type: string
        - name: showAgentless
          in: query
          description: 'When true, include agentless agents in the results'
          schema:
            type: boolean
            default: true
        - name: showInactive
          in: query
          description: 'When true, include inactive agents in the results'
          schema:
            type: boolean
            default: false
        - name: withMetrics
          in: query
          description: 'When true, include CPU and memory metrics in the response'
          schema:
            type: boolean
            default: false
        - name: showUpgradeable
          in: query
          description: 'When true, only return agents that are upgradeable'
          schema:
            type: boolean
            default: false
        - name: getStatusSummary
          in: query
          description: 'When true, return a summary of agent statuses in the response'
          schema:
            type: boolean
            default: false
        - name: sortField
          in: query
          description: Field to sort results by
          schema:
            type: string
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending'
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: searchAfter
          in: query
          description: JSON-encoded array of sort values for `search_after` pagination
          schema:
            type: string
        - name: openPit
          in: query
          description: 'When true, opens a new point-in-time for pagination'
          schema:
            type: boolean
        - name: pitId
          in: query
          description: Point-in-time ID for pagination
          schema:
            type: string
        - name: pitKeepAlive
          in: query
          description: 'Duration to keep the point-in-time alive, for example, `1m`'
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - packages
                        - type
                        - active
                        - enrolled_at
                        - local_metadata
                        - effective_config
                      type: object
                      properties:
                        access_api_key:
                          type: string
                        access_api_key_id:
                          type: string
                        active:
                          type: boolean
                        agent:
                          required:
                            - id
                            - version
                          type: object
                          properties:
                            id:
                              type: string
                            type:
                              type: string
                            version:
                              type: string
                        audit_unenrolled_reason:
                          type: string
                        capabilities:
                          maxItems: 100
                          type: array
                          items:
                            type: string
                        components:
                          maxItems: 10000
                          type: array
                          items:
                            required:
                              - id
                              - type
                              - status
                              - message
                            type: object
                            properties:
                              id:
                                type: string
                              message:
                                type: string
                              status:
                                enum:
                                  - STARTING
                                  - CONFIGURING
                                  - HEALTHY
                                  - DEGRADED
                                  - FAILED
                                  - STOPPING
                                  - STOPPED
                                type: string
                              type:
                                type: string
                              units:
                                maxItems: 10000
                                type: array
                                items:
                                  required:
                                    - id
                                    - type
                                    - status
                                    - message
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                    message:
                                      type: string
                                    payload:
                                      type: object
                                      additionalProperties: { }
                                    status:
                                      enum:
                                        - STARTING
                                        - CONFIGURING
                                        - HEALTHY
                                        - DEGRADED
                                        - FAILED
                                        - STOPPING
                                        - STOPPED
                                      type: string
                                    type:
                                      enum:
                                        - input
                                        - output
                                        - ''
                                      type: string
                                  additionalProperties: false
                            additionalProperties: false
                        default_api_key:
                          type: string
                        default_api_key_history:
                          maxItems: 100
                          type: array
                          items:
                            required:
                              - id
                              - retired_at
                            type: object
                            properties:
                              id:
                                type: string
                              retired_at:
                                type: string
                            additionalProperties: false
                            deprecated: true
                        default_api_key_id:
                          type: string
                        effective_config: { }
                        enrolled_at:
                          type: string
                        health:
                          type: object
                          additionalProperties: { }
                        id:
                          type: string
                        identifying_attributes:
                          type: object
                          additionalProperties:
                            type: string
                        last_checkin:
                          type: string
                        last_checkin_message:
                          type: string
                        last_checkin_status:
                          enum:
                            - error
                            - online
                            - degraded
                            - updating
                            - starting
                            - disconnected
                          type: string
                        last_known_status:
                          enum:
                            - offline
                            - error
                            - online
                            - inactive
                            - enrolling
                            - unenrolling
                            - unenrolled
                            - updating
                            - degraded
                            - uninstalled
                            - orphaned
                          type: string
                        local_metadata:
                          type: object
                          additionalProperties: { }
                        metrics:
                          type: object
                          properties:
                            cpu_avg:
                              type: number
                            memory_size_byte_avg:
                              type: number
                          additionalProperties: false
                        namespaces:
                          maxItems: 100
                          type: array
                          items:
                            type: string
                        non_identifying_attributes:
                          type: object
                          additionalProperties:
                            type: string
                        outputs:
                          type: object
                          additionalProperties:
                            type: object
                            properties:
                              api_key_id:
                                type: string
                              to_retire_api_key_ids:
                                maxItems: 100
                                type: array
                                items:
                                  required:
                                    - id
                                    - retired_at
                                  type: object
                                  properties:
                                    id:
                                      type: string
                                    retired_at:
                                      type: string
                                  additionalProperties: false
                              type:
                                type: string
                            additionalProperties: false
                        packages:
                          maxItems: 10000
                          type: array
                          items:
                            type: string
                        pipeline_config:
                          maxLength: 10000
                          type: string
                        policy_base_id:
                          type: string
                        policy_id:
                          type: string
                        policy_revision:
                          type:
                            - 'null'
                            - number
                        sequence_num:
                          type: number
                        signals:
                          maxItems: 50
                          type: array
                          items:
                            type: string
                        sort:
                          maxItems: 10
                          type: array
                          items: { }
                        status:
                          enum:
                            - offline
                            - error
                            - online
                            - inactive
                            - enrolling
                            - unenrolling
                            - unenrolled
                            - updating
                            - degraded
                            - uninstalled
                            - orphaned
                          type: string
                        tags:
                          maxItems: 100
                          type: array
                          items:
                            type: string
                        type:
                          enum:
                            - PERMANENT
                            - EPHEMERAL
                            - TEMPORARY
                            - OPAMP
                          type: string
                        unenrolled_at:
                          type: string
                        unenrollment_started_at:
                          type: string
                        unhealthy_reason:
                          maxItems: 3
                          type:
                            - 'null'
                            - array
                          items:
                            enum:
                              - input
                              - output
                              - other
                            type: string
                        upgrade:
                          type: object
                          properties:
                            rollbacks:
                              maxItems: 100
                              type: array
                              items:
                                required:
                                  - valid_until
                                  - version
                                type: object
                                properties:
                                  valid_until:
                                    type: string
                                  version:
                                    type: string
                                additionalProperties: false
                          additionalProperties: false
                        upgrade_attempts:
                          maxItems: 10000
                          type:
                            - 'null'
                            - array
                          items:
                            type: string
                        upgrade_details:
                          required:
                            - target_version
                            - action_id
                            - state
                          type:
                            - 'null'
                            - object
                          properties:
                            action_id:
                              type: string
                            metadata:
                              type: object
                              properties:
                                download_percent:
                                  type: number
                                download_rate:
                                  type: number
                                error_msg:
                                  type: string
                                failed_state:
                                  enum:
                                    - UPG_REQUESTED
                                    - UPG_SCHEDULED
                                    - UPG_DOWNLOADING
                                    - UPG_EXTRACTING
                                    - UPG_REPLACING
                                    - UPG_RESTARTING
                                    - UPG_FAILED
                                    - UPG_WATCHING
                                    - UPG_ROLLBACK
                                  type: string
                                reason:
                                  type: string
                                retry_error_msg:
                                  type: string
                                retry_until:
                                  type: string
                                scheduled_at:
                                  type: string
                              additionalProperties: false
                            state:
                              enum:
                                - UPG_REQUESTED
                                - UPG_SCHEDULED
                                - UPG_DOWNLOADING
                                - UPG_EXTRACTING
                                - UPG_REPLACING
                                - UPG_RESTARTING
                                - UPG_FAILED
                                - UPG_WATCHING
                                - UPG_ROLLBACK
                              type: string
                            target_version:
                              type: string
                          additionalProperties: false
                        upgrade_started_at:
                          type:
                            - 'null'
                            - string
                        upgraded_at:
                          type:
                            - 'null'
                            - string
                        user_provided_metadata:
                          type: object
                          additionalProperties: { }
                      additionalProperties: false
                  nextSearchAfter:
                    type: string
                  page:
                    type: number
                  perPage:
                    type: number
                  pit:
                    type: string
                  statusSummary:
                    type: object
                    additionalProperties:
                      type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getAgentsExample:
                  description: List of agents
                  value:
                    items:
                      - active: true
                        enrolled_at: '2024-01-01T00:00:00.000Z'
                        id: agent-id-1
                        policy_id: agent-policy-id-1
                        policy_revision: 1
                        status: online
                        type: PERMANENT
                        updated_at: '2024-01-01T00:00:00.000Z'
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Agents
      summary: Get agents by action ids
      description: 'Retrieve agents associated with specific action IDs.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: post-fleet-agents
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - actionIds
              type: object
              properties:
                actionIds:
                  maxItems: 1000
                  type: array
                  items:
                    type: string
              additionalProperties: false
            examples:
              postGetAgentsByActionsRequestExample:
                description: Retrieve agents associated with specific action IDs
                value:
                  actionIds:
                    - action-id-1
                    - action-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      type: string
                additionalProperties: false
              examples:
                postGetAgentsByActionsExample:
                  description: Agents associated with the given actions
                  value:
                    items:
                      - active: true
                        id: agent-id-1
                        policy_id: agent-policy-id-1
                        status: online
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}':
    delete:
      tags:
        - Elastic Agents
      summary: Delete an agent
      description: 'Delete an agent by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: delete-fleet-agents-agentid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - action
                type: object
                properties:
                  action:
                    enum:
                      - deleted
                    type: string
                additionalProperties: false
              examples:
                deleteAgentExample:
                  description: Agent successfully deleted
                  value:
                    id: agent-id-1
                    success: true
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent was found with the given ID
                  value:
                    error: Not Found
                    message: Agent agent-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Elastic Agents
      summary: Get an agent
      description: 'Get an agent by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-agentid
      parameters:
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
        - name: withMetrics
          in: query
          description: 'When true, include CPU and memory metrics in the response'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - packages
                      - type
                      - active
                      - enrolled_at
                      - local_metadata
                      - effective_config
                    type: object
                    properties:
                      access_api_key:
                        type: string
                      access_api_key_id:
                        type: string
                      active:
                        type: boolean
                      agent:
                        required:
                          - id
                          - version
                        type: object
                        properties:
                          id:
                            type: string
                          type:
                            type: string
                          version:
                            type: string
                      audit_unenrolled_reason:
                        type: string
                      capabilities:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      components:
                        maxItems: 10000
                        type: array
                        items:
                          required:
                            - id
                            - type
                            - status
                            - message
                          type: object
                          properties:
                            id:
                              type: string
                            message:
                              type: string
                            status:
                              enum:
                                - STARTING
                                - CONFIGURING
                                - HEALTHY
                                - DEGRADED
                                - FAILED
                                - STOPPING
                                - STOPPED
                              type: string
                            type:
                              type: string
                            units:
                              maxItems: 10000
                              type: array
                              items:
                                required:
                                  - id
                                  - type
                                  - status
                                  - message
                                type: object
                                properties:
                                  id:
                                    type: string
                                  message:
                                    type: string
                                  payload:
                                    type: object
                                    additionalProperties: { }
                                  status:
                                    enum:
                                      - STARTING
                                      - CONFIGURING
                                      - HEALTHY
                                      - DEGRADED
                                      - FAILED
                                      - STOPPING
                                      - STOPPED
                                    type: string
                                  type:
                                    enum:
                                      - input
                                      - output
                                      - ''
                                    type: string
                                additionalProperties: false
                          additionalProperties: false
                      default_api_key:
                        type: string
                      default_api_key_history:
                        maxItems: 100
                        type: array
                        items:
                          required:
                            - id
                            - retired_at
                          type: object
                          properties:
                            id:
                              type: string
                            retired_at:
                              type: string
                          additionalProperties: false
                          deprecated: true
                      default_api_key_id:
                        type: string
                      effective_config: { }
                      enrolled_at:
                        type: string
                      health:
                        type: object
                        additionalProperties: { }
                      id:
                        type: string
                      identifying_attributes:
                        type: object
                        additionalProperties:
                          type: string
                      last_checkin:
                        type: string
                      last_checkin_message:
                        type: string
                      last_checkin_status:
                        enum:
                          - error
                          - online
                          - degraded
                          - updating
                          - starting
                          - disconnected
                        type: string
                      last_known_status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      local_metadata:
                        type: object
                        additionalProperties: { }
                      metrics:
                        type: object
                        properties:
                          cpu_avg:
                            type: number
                          memory_size_byte_avg:
                            type: number
                        additionalProperties: false
                      namespaces:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      non_identifying_attributes:
                        type: object
                        additionalProperties:
                          type: string
                      outputs:
                        type: object
                        additionalProperties:
                          type: object
                          properties:
                            api_key_id:
                              type: string
                            to_retire_api_key_ids:
                              maxItems: 100
                              type: array
                              items:
                                required:
                                  - id
                                  - retired_at
                                type: object
                                properties:
                                  id:
                                    type: string
                                  retired_at:
                                    type: string
                                additionalProperties: false
                            type:
                              type: string
                          additionalProperties: false
                      packages:
                        maxItems: 10000
                        type: array
                        items:
                          type: string
                      pipeline_config:
                        maxLength: 10000
                        type: string
                      policy_base_id:
                        type: string
                      policy_id:
                        type: string
                      policy_revision:
                        type:
                          - 'null'
                          - number
                      sequence_num:
                        type: number
                      signals:
                        maxItems: 50
                        type: array
                        items:
                          type: string
                      sort:
                        maxItems: 10
                        type: array
                        items: { }
                      status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      tags:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      type:
                        enum:
                          - PERMANENT
                          - EPHEMERAL
                          - TEMPORARY
                          - OPAMP
                        type: string
                      unenrolled_at:
                        type: string
                      unenrollment_started_at:
                        type: string
                      unhealthy_reason:
                        maxItems: 3
                        type:
                          - 'null'
                          - array
                        items:
                          enum:
                            - input
                            - output
                            - other
                          type: string
                      upgrade:
                        type: object
                        properties:
                          rollbacks:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - valid_until
                                - version
                              type: object
                              properties:
                                valid_until:
                                  type: string
                                version:
                                  type: string
                              additionalProperties: false
                        additionalProperties: false
                      upgrade_attempts:
                        maxItems: 10000
                        type:
                          - 'null'
                          - array
                        items:
                          type: string
                      upgrade_details:
                        required:
                          - target_version
                          - action_id
                          - state
                        type:
                          - 'null'
                          - object
                        properties:
                          action_id:
                            type: string
                          metadata:
                            type: object
                            properties:
                              download_percent:
                                type: number
                              download_rate:
                                type: number
                              error_msg:
                                type: string
                              failed_state:
                                enum:
                                  - UPG_REQUESTED
                                  - UPG_SCHEDULED
                                  - UPG_DOWNLOADING
                                  - UPG_EXTRACTING
                                  - UPG_REPLACING
                                  - UPG_RESTARTING
                                  - UPG_FAILED
                                  - UPG_WATCHING
                                  - UPG_ROLLBACK
                                type: string
                              reason:
                                type: string
                              retry_error_msg:
                                type: string
                              retry_until:
                                type: string
                              scheduled_at:
                                type: string
                            additionalProperties: false
                          state:
                            enum:
                              - UPG_REQUESTED
                              - UPG_SCHEDULED
                              - UPG_DOWNLOADING
                              - UPG_EXTRACTING
                              - UPG_REPLACING
                              - UPG_RESTARTING
                              - UPG_FAILED
                              - UPG_WATCHING
                              - UPG_ROLLBACK
                            type: string
                          target_version:
                            type: string
                        additionalProperties: false
                      upgrade_started_at:
                        type:
                          - 'null'
                          - string
                      upgraded_at:
                        type:
                          - 'null'
                          - string
                      user_provided_metadata:
                        type: object
                        additionalProperties: { }
                    additionalProperties: false
                additionalProperties: false
              examples:
                getAgentExample:
                  description: Agent details
                  value:
                    item:
                      active: true
                      agent_id: agent-id-1
                      enrolled_at: '2024-01-01T00:00:00.000Z'
                      id: agent-id-1
                      local_metadata:
                        elastic:
                          agent:
                            version: '8.17.0'
                        host:
                          hostname: my-host
                        os:
                          name: linux
                      policy_id: agent-policy-id-1
                      policy_revision: 1
                      status: online
                      type: PERMANENT
                      updated_at: '2024-01-01T00:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent was found with the given ID
                  value:
                    error: Not Found
                    message: Agent agent-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Elastic Agents
      summary: Update an agent by ID
      description: 'Update an agent by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: put-fleet-agents-agentid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                tags:
                  maxItems: 10
                  type: array
                  items:
                    type: string
                user_provided_metadata:
                  type: object
                  additionalProperties: { }
              additionalProperties: false
            examples:
              putAgentRequestExample:
                description: Update agent tags
                value:
                  tags:
                    - production
                    - linux
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - packages
                      - type
                      - active
                      - enrolled_at
                      - local_metadata
                      - effective_config
                    type: object
                    properties:
                      access_api_key:
                        type: string
                      access_api_key_id:
                        type: string
                      active:
                        type: boolean
                      agent:
                        required:
                          - id
                          - version
                        type: object
                        properties:
                          id:
                            type: string
                          type:
                            type: string
                          version:
                            type: string
                      audit_unenrolled_reason:
                        type: string
                      capabilities:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      components:
                        maxItems: 10000
                        type: array
                        items:
                          required:
                            - id
                            - type
                            - status
                            - message
                          type: object
                          properties:
                            id:
                              type: string
                            message:
                              type: string
                            status:
                              enum:
                                - STARTING
                                - CONFIGURING
                                - HEALTHY
                                - DEGRADED
                                - FAILED
                                - STOPPING
                                - STOPPED
                              type: string
                            type:
                              type: string
                            units:
                              maxItems: 10000
                              type: array
                              items:
                                required:
                                  - id
                                  - type
                                  - status
                                  - message
                                type: object
                                properties:
                                  id:
                                    type: string
                                  message:
                                    type: string
                                  payload:
                                    type: object
                                    additionalProperties: { }
                                  status:
                                    enum:
                                      - STARTING
                                      - CONFIGURING
                                      - HEALTHY
                                      - DEGRADED
                                      - FAILED
                                      - STOPPING
                                      - STOPPED
                                    type: string
                                  type:
                                    enum:
                                      - input
                                      - output
                                      - ''
                                    type: string
                                additionalProperties: false
                          additionalProperties: false
                      default_api_key:
                        type: string
                      default_api_key_history:
                        maxItems: 100
                        type: array
                        items:
                          required:
                            - id
                            - retired_at
                          type: object
                          properties:
                            id:
                              type: string
                            retired_at:
                              type: string
                          additionalProperties: false
                          deprecated: true
                      default_api_key_id:
                        type: string
                      effective_config: { }
                      enrolled_at:
                        type: string
                      health:
                        type: object
                        additionalProperties: { }
                      id:
                        type: string
                      identifying_attributes:
                        type: object
                        additionalProperties:
                          type: string
                      last_checkin:
                        type: string
                      last_checkin_message:
                        type: string
                      last_checkin_status:
                        enum:
                          - error
                          - online
                          - degraded
                          - updating
                          - starting
                          - disconnected
                        type: string
                      last_known_status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      local_metadata:
                        type: object
                        additionalProperties: { }
                      metrics:
                        type: object
                        properties:
                          cpu_avg:
                            type: number
                          memory_size_byte_avg:
                            type: number
                        additionalProperties: false
                      namespaces:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      non_identifying_attributes:
                        type: object
                        additionalProperties:
                          type: string
                      outputs:
                        type: object
                        additionalProperties:
                          type: object
                          properties:
                            api_key_id:
                              type: string
                            to_retire_api_key_ids:
                              maxItems: 100
                              type: array
                              items:
                                required:
                                  - id
                                  - retired_at
                                type: object
                                properties:
                                  id:
                                    type: string
                                  retired_at:
                                    type: string
                                additionalProperties: false
                            type:
                              type: string
                          additionalProperties: false
                      packages:
                        maxItems: 10000
                        type: array
                        items:
                          type: string
                      pipeline_config:
                        maxLength: 10000
                        type: string
                      policy_base_id:
                        type: string
                      policy_id:
                        type: string
                      policy_revision:
                        type:
                          - 'null'
                          - number
                      sequence_num:
                        type: number
                      signals:
                        maxItems: 50
                        type: array
                        items:
                          type: string
                      sort:
                        maxItems: 10
                        type: array
                        items: { }
                      status:
                        enum:
                          - offline
                          - error
                          - online
                          - inactive
                          - enrolling
                          - unenrolling
                          - unenrolled
                          - updating
                          - degraded
                          - uninstalled
                          - orphaned
                        type: string
                      tags:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      type:
                        enum:
                          - PERMANENT
                          - EPHEMERAL
                          - TEMPORARY
                          - OPAMP
                        type: string
                      unenrolled_at:
                        type: string
                      unenrollment_started_at:
                        type: string
                      unhealthy_reason:
                        maxItems: 3
                        type:
                          - 'null'
                          - array
                        items:
                          enum:
                            - input
                            - output
                            - other
                          type: string
                      upgrade:
                        type: object
                        properties:
                          rollbacks:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - valid_until
                                - version
                              type: object
                              properties:
                                valid_until:
                                  type: string
                                version:
                                  type: string
                              additionalProperties: false
                        additionalProperties: false
                      upgrade_attempts:
                        maxItems: 10000
                        type:
                          - 'null'
                          - array
                        items:
                          type: string
                      upgrade_details:
                        required:
                          - target_version
                          - action_id
                          - state
                        type:
                          - 'null'
                          - object
                        properties:
                          action_id:
                            type: string
                          metadata:
                            type: object
                            properties:
                              download_percent:
                                type: number
                              download_rate:
                                type: number
                              error_msg:
                                type: string
                              failed_state:
                                enum:
                                  - UPG_REQUESTED
                                  - UPG_SCHEDULED
                                  - UPG_DOWNLOADING
                                  - UPG_EXTRACTING
                                  - UPG_REPLACING
                                  - UPG_RESTARTING
                                  - UPG_FAILED
                                  - UPG_WATCHING
                                  - UPG_ROLLBACK
                                type: string
                              reason:
                                type: string
                              retry_error_msg:
                                type: string
                              retry_until:
                                type: string
                              scheduled_at:
                                type: string
                            additionalProperties: false
                          state:
                            enum:
                              - UPG_REQUESTED
                              - UPG_SCHEDULED
                              - UPG_DOWNLOADING
                              - UPG_EXTRACTING
                              - UPG_REPLACING
                              - UPG_RESTARTING
                              - UPG_FAILED
                              - UPG_WATCHING
                              - UPG_ROLLBACK
                            type: string
                          target_version:
                            type: string
                        additionalProperties: false
                      upgrade_started_at:
                        type:
                          - 'null'
                          - string
                      upgraded_at:
                        type:
                          - 'null'
                          - string
                      user_provided_metadata:
                        type: object
                        additionalProperties: { }
                    additionalProperties: false
                additionalProperties: false
              examples:
                putAgentExample:
                  description: Updated agent details
                  value:
                    item:
                      active: true
                      enrolled_at: '2024-01-01T00:00:00.000Z'
                      id: agent-id-1
                      policy_id: agent-policy-id-1
                      policy_revision: 1
                      status: online
                      tags:
                        - production
                        - linux
                      type: PERMANENT
                      updated_at: '2024-01-01T00:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No agent was found with the given ID
                  value:
                    error: Not Found
                    message: Agent agent-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/actions':
    post:
      tags:
        - Elastic Agent actions
      summary: Create an agent action
      description: 'Create a new action for a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-actions
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - action
              type: object
              properties:
                action:
                  anyOf:
                    - required:
                        - type
                        - data
                        - ack_data
                      type: object
                      properties:
                        ack_data: { }
                        data: { }
                        type:
                          enum:
                            - UNENROLL
                            - UPGRADE
                            - POLICY_REASSIGN
                          type: string
                      additionalProperties: false
                    - required:
                        - type
                        - data
                      type: object
                      properties:
                        data:
                          type: object
                          properties:
                            log_level:
                              enum:
                                - debug
                                - info
                                - warning
                                - error
                                - 'null'
                              type:
                                - 'null'
                                - string
                              default: 'null'
                          additionalProperties: false
                        type:
                          enum:
                            - SETTINGS
                          type: string
                      additionalProperties: false
              additionalProperties: false
            examples:
              postAgentActionRequestExample:
                description: Create a UNENROLL action for an agent
                value:
                  action:
                    type: UNENROLL
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - type
                      - data
                      - created_at
                      - ack_data
                    type: object
                    properties:
                      ack_data: { }
                      agents:
                        maxItems: 10000
                        type: array
                        items:
                          type: string
                      created_at:
                        type: string
                      data: { }
                      expiration:
                        type: string
                      id:
                        type: string
                      minimum_execution_duration:
                        type: number
                      namespaces:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      rollout_duration_seconds:
                        type: number
                      sent_at:
                        type: string
                      source_uri:
                        type: string
                      start_time:
                        type: string
                      total:
                        type: number
                      type:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                postAgentActionExample:
                  description: Created agent action
                  value:
                    item:
                      agents:
                        - agent-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: action-id-1
                      type: UNENROLL
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/effective_config':
    get:
      tags:
        - Elastic Agents
      summary: Get an agent's effective config
      description: 'Get an agent''s effective config by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-agentid-effective-config
      parameters:
        - name: agentId
          in: path
          description: The agent ID to get effective config of
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                required:
                  - effective_config
                type: object
                properties:
                  effective_config: { }
                additionalProperties: false
              examples:
                successResponse:
                  value:
                    effective_config: { }
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/migrate':
    post:
      tags:
        - Elastic Agents
      summary: Migrate a single agent
      description: 'Migrate a single agent to another cluster.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-migrate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - uri
                - enrollment_token
              type: object
              properties:
                enrollment_token:
                  type: string
                settings:
                  type: object
                  properties:
                    ca_sha256:
                      type: string
                    certificate_authorities:
                      type: string
                    elastic_agent_cert:
                      type: string
                    elastic_agent_cert_key:
                      type: string
                    elastic_agent_cert_key_passphrase:
                      type: string
                    headers:
                      type: object
                      additionalProperties:
                        type: string
                    insecure:
                      type: boolean
                    proxy_disabled:
                      type: boolean
                    proxy_headers:
                      type: object
                      additionalProperties:
                        type: string
                    proxy_url:
                      type: string
                    replace_token:
                      type: string
                    staging:
                      type: string
                    tags:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                  additionalProperties: false
                uri:
                  type: string
                  format: uri
              additionalProperties: false
            examples:
              postMigrateAgentRequestExample:
                description: Migrate a single agent to another cluster
                value:
                  enrollment_token: enrollment-token-value
                  settings:
                    retry_max: 5
                  uri: https://fleet-server.example.com:8220
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - actionId
                type: object
                properties:
                  actionId:
                    type: string
                additionalProperties: false
              examples:
                postMigrateAgentExample:
                  description: Agent migration initiated
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/privilege_level_change':
    post:
      tags:
        - Elastic Agents
      summary: Change agent privilege level
      description: 'Change the privilege level of a single agent to unprivileged.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-privilege-level-change
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID to change privilege level for
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type:
                - 'null'
                - object
              properties:
                user_info:
                  type: object
                  properties:
                    groupname:
                      type: string
                    password:
                      type: string
                    username:
                      type: string
                  additionalProperties: false
              additionalProperties: false
              default: 'null'
            examples:
              changeAgentPrivilegeLevelRequest:
                value:
                  user_info:
                    groupname: groupname
                    password: password
                    username: username
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_id_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_message_response'
              examples:
                successResponse:
                  value:
                    actionId: actionId
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/reassign':
    post:
      tags:
        - Elastic Agent actions
      summary: Reassign an agent
      description: 'Reassign an agent to a different agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-reassign
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - policy_id
              type: object
              properties:
                policy_id:
                  type: string
              additionalProperties: false
            examples:
              postReassignAgentRequestExample:
                description: Reassign an agent to a different policy
                value:
                  policy_id: agent-policy-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
              examples:
                postReassignAgentExample:
                  description: Agent successfully reassigned
                  value: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/remove_collector':
    post:
      tags:
        - Elastic Agent actions
      summary: Remove an OpAMP collector
      description: 'Remove a specific OpAMP collector from the Fleet agents list. Marks the collector as unenrolled. This action does not invalidate API keys, so the collector can reconnect on its own.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-remove-collector
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The collector agent ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              examples:
                postRemoveCollectorExample:
                  description: Collector successfully removed
                  value: { }
        '400':
          description: Bad Request
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/request_diagnostics':
    post:
      tags:
        - Elastic Agent actions
      summary: Request agent diagnostics
      description: 'Request a diagnostics bundle from a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: post-fleet-agents-agentid-request-diagnostics
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type:
                - 'null'
                - object
              properties:
                additional_metrics:
                  maxItems: 1
                  type: array
                  items:
                    enum:
                      - CPU
                    type: string
              additionalProperties: false
              default: 'null'
            examples:
              postRequestDiagnosticsRequestExample:
                description: Request a diagnostics bundle from an agent
                value:
                  additional_metrics:
                    - CPU
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postRequestDiagnosticsExample:
                  description: Diagnostics action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: Agent agent-id-1 does not support request diagnostics action.
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/rollback':
    post:
      tags:
        - Elastic Agent actions
      summary: Rollback an agent
      description: 'Rollback an agent to the previous version.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-rollback
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID to rollback
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_id_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_action_message_response'
              examples:
                successResponse:
                  value:
                    actionId: actionId
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/unenroll':
    post:
      tags:
        - Elastic Agent actions
      summary: Unenroll an agent
      description: 'Unenroll a specific agent, optionally revoking its enrollment API key.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-unenroll
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type:
                - 'null'
                - object
              properties:
                force:
                  type: boolean
                revoke:
                  type: boolean
              additionalProperties: false
              default: 'null'
            examples:
              postUnenrollAgentRequestExample:
                description: 'Unenroll an agent, optionally revoking the enrollment API key'
                value:
                  revoke: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              examples:
                postUnenrollAgentExample:
                  description: Agent successfully unenrolled
                  value: { }
        '400':
          description: Bad Request
          content:
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/upgrade':
    post:
      tags:
        - Elastic Agent actions
      summary: Upgrade an agent
      description: 'Upgrade a specific agent to a newer version.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-agentid-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - version
              type: object
              properties:
                force:
                  type: boolean
                skipRateLimitCheck:
                  type: boolean
                source_uri:
                  type: string
                version:
                  type: string
              additionalProperties: false
            examples:
              postUpgradeAgentRequestExample:
                description: Upgrade an agent to a specific version
                value:
                  version: '8.17.0'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                additionalProperties: false
              examples:
                postUpgradeAgentExample:
                  description: Agent upgrade initiated
                  value: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/{agentId}/uploads':
    get:
      tags:
        - Elastic Agents
      summary: Get agent uploads
      description: 'Get a list of files uploaded by a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-agentid-uploads
      parameters:
        - name: agentId
          in: path
          description: The agent ID
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - name
                        - filePath
                        - createTime
                        - status
                        - actionId
                      type: object
                      properties:
                        actionId:
                          type: string
                        createTime:
                          type: string
                        error:
                          type: string
                        filePath:
                          type: string
                        id:
                          type: string
                        name:
                          type: string
                        status:
                          enum:
                            - READY
                            - AWAITING_UPLOAD
                            - DELETED
                            - EXPIRED
                            - IN_PROGRESS
                            - FAILED
                          type: string
                      additionalProperties: false
                additionalProperties: false
              examples:
                getAgentUploadsExample:
                  description: List of files uploaded by the agent
                  value:
                    items:
                      - actionId: action-id-1
                        createTime: '2024-01-01T00:00:00.000Z'
                        filePath: /tmp/diagnostics-2024-01-01.zip
                        id: file-id-1
                        name: diagnostics-2024-01-01.zip
                        status: READY
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/action_status:
    get:
      tags:
        - Elastic Agent actions
      summary: Get an agent action status
      description: 'Get the current status of recent agent actions.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-action-status
      parameters:
        - name: page
          in: query
          description: Page number
          schema:
            type: number
            default: 0
        - name: perPage
          in: query
          description: Number of results per page
          schema:
            type: number
            default: 20
        - name: date
          in: query
          description: Return actions created before this date
          schema:
            type: string
        - name: latest
          in: query
          description: Return only the latest N actions
          schema:
            type: number
        - name: scheduledOnly
          in: query
          description: Return only actions whose start_time is in the future
          schema:
            type: boolean
        - name: errorSize
          in: query
          description: Number of error details to include per action
          schema:
            type: number
            default: 5
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - actionId
                        - nbAgentsActionCreated
                        - nbAgentsAck
                        - nbAgentsFailed
                        - type
                        - nbAgentsActioned
                        - status
                        - creationTime
                      type: object
                      properties:
                        actionId:
                          type: string
                        cancellationTime:
                          type: string
                        completionTime:
                          type: string
                        creationTime:
                          type: string
                          description: creation time of action
                        expiration:
                          type: string
                        hasRolloutPeriod:
                          type: boolean
                        is_automatic:
                          type: boolean
                        latestErrors:
                          maxItems: 10
                          type: array
                          items:
                            required:
                              - agentId
                              - error
                              - timestamp
                            type: object
                            properties:
                              agentId:
                                type: string
                              error:
                                type: string
                              hostname:
                                type: string
                              timestamp:
                                type: string
                            additionalProperties: false
                            description: latest errors that happened when the agents executed the action
                        nbAgentsAck:
                          type: number
                          description: number of agents that acknowledged the action
                        nbAgentsActionCreated:
                          type: number
                          description: number of agents included in action from kibana
                        nbAgentsActioned:
                          type: number
                          description: number of agents actioned
                        nbAgentsFailed:
                          type: number
                          description: number of agents that failed to execute the action
                        newPolicyId:
                          type: string
                          description: new policy id (POLICY_REASSIGN action)
                        policyId:
                          type: string
                          description: policy id (POLICY_CHANGE action)
                        revision:
                          type: number
                          description: new policy revision (POLICY_CHANGE action)
                        startTime:
                          type: string
                          description: start time of action (scheduled actions)
                        status:
                          enum:
                            - COMPLETE
                            - EXPIRED
                            - CANCELLED
                            - FAILED
                            - IN_PROGRESS
                            - ROLLOUT_PASSED
                          type: string
                        type:
                          enum:
                            - UPGRADE
                            - UNENROLL
                            - SETTINGS
                            - POLICY_REASSIGN
                            - CANCEL
                            - FORCE_UNENROLL
                            - REQUEST_DIAGNOSTICS
                            - UPDATE_TAGS
                            - POLICY_CHANGE
                            - INPUT_ACTION
                            - MIGRATE
                            - PRIVILEGE_LEVEL_CHANGE
                            - ROLLBACK
                            - REMOVE_COLLECTOR
                          type: string
                        version:
                          type: string
                          description: agent version number (UPGRADE action)
                      additionalProperties: false
                additionalProperties: false
              examples:
                getActionStatusExample:
                  description: Status of recent agent actions
                  value:
                    items:
                      - actionId: action-id-1
                        completionTime: '2024-01-01T00:05:00.000Z'
                        creationTime: '2024-01-01T00:00:00.000Z'
                        nbAgentsAck: 2
                        nbAgentsActioned: 2
                        nbAgentsFailed: 0
                        status: COMPLETE
                        type: UPGRADE
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/actions/{actionId}/cancel':
    post:
      tags:
        - Elastic Agent actions
      summary: Cancel an agent action
      description: 'Cancel a pending action for a specific agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-actions-actionid-cancel
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: actionId
          in: path
          description: The ID of the action to cancel
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            examples:
              postCancelActionRequestExample:
                description: Cancel an agent action
                value: { }
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - type
                      - data
                      - created_at
                      - ack_data
                    type: object
                    properties:
                      ack_data: { }
                      agents:
                        maxItems: 10000
                        type: array
                        items:
                          type: string
                      created_at:
                        type: string
                      data: { }
                      expiration:
                        type: string
                      id:
                        type: string
                      minimum_execution_duration:
                        type: number
                      namespaces:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      rollout_duration_seconds:
                        type: number
                      sent_at:
                        type: string
                      source_uri:
                        type: string
                      start_time:
                        type: string
                      total:
                        type: number
                      type:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                postCancelActionExample:
                  description: Cancellation action created
                  value:
                    item:
                      agents:
                        - agent-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: cancel-action-id-1
                      type: CANCEL
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/available_versions:
    get:
      tags:
        - Elastic Agents
      summary: Get available agent versions
      description: 'Get a list of Elastic Agent versions available for upgrade.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-available-versions
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      type: string
                additionalProperties: false
              examples:
                getAvailableVersionsExample:
                  description: List of available agent versions for upgrade
                  value:
                    items:
                      - '8.17.0'
                      - '8.16.3'
                      - '8.16.2'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_migrate:
    post:
      tags:
        - Elastic Agents
      summary: Migrate multiple agents
      description: 'Bulk migrate agents to another cluster.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-migrate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
                - uri
                - enrollment_token
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                enrollment_token:
                  type: string
                settings:
                  type: object
                  properties:
                    ca_sha256:
                      type: string
                    certificate_authorities:
                      type: string
                    elastic_agent_cert:
                      type: string
                    elastic_agent_cert_key:
                      type: string
                    elastic_agent_cert_key_passphrase:
                      type: string
                    headers:
                      type: object
                      additionalProperties:
                        type: string
                    insecure:
                      type: boolean
                    proxy_disabled:
                      type: boolean
                    proxy_headers:
                      type: object
                      additionalProperties:
                        type: string
                    proxy_url:
                      type: string
                    staging:
                      type: string
                    tags:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                  additionalProperties: false
                uri:
                  type: string
                  format: uri
              additionalProperties: false
            examples:
              postBulkMigrateAgentsRequestExample:
                description: Migrate multiple agents to another cluster
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  enrollment_token: enrollment-token-value
                  settings:
                    retry_max: 5
                  uri: https://fleet-server.example.com:8220
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkMigrateAgentsExample:
                  description: Bulk agent migration initiated
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_privilege_level_change:
    post:
      tags:
        - Elastic Agents
      summary: Bulk change agent privilege level
      description: 'Change multiple agents'' privilege level to unprivileged.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-privilege-level-change
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                user_info:
                  type: object
                  properties:
                    groupname:
                      type: string
                    password:
                      type: string
                    username:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            examples:
              bulkChangeAgentPrivilegeLevelRequest:
                value:
                  agents: agent
                  user_info:
                    groupname: groupname
                    password: password
                    username: username
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                successResponse:
                  value:
                    actionId: actionId
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_reassign:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk reassign agents
      description: 'Reassign multiple agents to a different agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-reassign
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - policy_id
                - agents
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                includeInactive:
                  type: boolean
                  default: false
                policy_id:
                  type: string
              additionalProperties: false
            examples:
              postBulkReassignAgentsRequestExample:
                description: Reassign multiple agents to a different policy
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  policy_id: agent-policy-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkReassignAgentsExample:
                  description: Bulk reassign action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_remove_collectors:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk remove OpAMP collectors
      description: 'Remove multiple OpAMP collectors from the Fleet agents list. Marks the collectors as unenrolled. This action does not invalidate API keys, so collectors can reconnect on their own.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-remove-collectors
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                        description: List of collector agent IDs
                    - type: string
                      description: KQL query string. Leave empty to target all collectors
                dryRun:
                  type: boolean
                includeInactive:
                  type: boolean
                  description: 'When passing collectors by KQL query, also removes inactive collectors'
              additionalProperties: false
            examples:
              postBulkRemoveCollectorsRequestExample:
                description: Remove multiple OpAMP collectors
                value:
                  agents:
                    - collector-id-1
                    - collector-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkRemoveCollectorsExample:
                  description: Bulk remove collectors action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_request_diagnostics:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk request diagnostics from agents
      description: 'Request diagnostics bundles from multiple agents.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: post-fleet-agents-bulk-request-diagnostics
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
              type: object
              properties:
                additional_metrics:
                  maxItems: 1
                  type: array
                  items:
                    enum:
                      - CPU
                    type: string
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
              additionalProperties: false
            examples:
              postBulkRequestDiagnosticsRequestExample:
                description: Request diagnostics bundles from multiple agents
                value:
                  additional_metrics:
                    - CPU
                  agents:
                    - agent-id-1
                    - agent-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkRequestDiagnosticsExample:
                  description: Bulk diagnostics action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_rollback:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk rollback agents
      description: 'Rollback multiple agents to the previous version.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-rollback
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                includeInactive:
                  type: boolean
                  default: false
              additionalProperties: false
            examples:
              bulkRollbackAgentsRequest:
                value:
                  agents:
                    - agent-1
                    - agent-2
                  batchSize: 100
                  includeInactive: false
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionIds
                    type: object
                    properties:
                      actionIds:
                        maxItems: 10000
                        type: array
                        items:
                          maxLength: 36
                          type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                successResponse:
                  value:
                    actionIds:
                      - actionId1
                      - actionId2
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_unenroll:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk unenroll agents
      description: 'Unenroll multiple agents, optionally revoking their enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-unenroll
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                        description: list of agent IDs
                    - type: string
                      description: 'KQL query string, leave empty to action all agents'
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                force:
                  type: boolean
                  description: Unenrolls hosted agents too
                includeInactive:
                  type: boolean
                  description: 'When passing agents by KQL query, unenrolls inactive agents too'
                revoke:
                  type: boolean
                  description: Revokes API keys of agents
              additionalProperties: false
            examples:
              postBulkUnenrollAgentsRequestExample:
                description: Unenroll multiple agents
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  revoke: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkUnenrollAgentsExample:
                  description: Bulk unenroll action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_update_agent_tags:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk update agent tags
      description: 'Add or remove tags across multiple agents.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-update-agent-tags
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                includeInactive:
                  type: boolean
                  default: false
                tagsToAdd:
                  maxItems: 10
                  type: array
                  items:
                    type: string
                tagsToRemove:
                  maxItems: 10
                  type: array
                  items:
                    type: string
              additionalProperties: false
            examples:
              postBulkUpdateAgentTagsRequestExample:
                description: Add and remove tags across multiple agents
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  tagsToAdd:
                    - production
                  tagsToRemove:
                    - staging
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkUpdateAgentTagsExample:
                  description: Bulk action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/bulk_upgrade:
    post:
      tags:
        - Elastic Agent actions
      summary: Bulk upgrade agents
      description: 'Upgrade multiple agents to a newer version, with optional rollout controls.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-agents-bulk-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agents
                - version
              type: object
              properties:
                agents:
                  anyOf:
                    - maxItems: 10000
                      type: array
                      items:
                        type: string
                    - type: string
                batchSize:
                  type: number
                dryRun:
                  type: boolean
                force:
                  type: boolean
                includeInactive:
                  type: boolean
                  default: false
                rollout_duration_seconds:
                  minimum: 600
                  type: number
                skipRateLimitCheck:
                  type: boolean
                source_uri:
                  type: string
                start_time:
                  type: string
                version:
                  type: string
              additionalProperties: false
            examples:
              postBulkUpgradeAgentsRequestExample:
                description: Upgrade multiple agents to a specific version
                value:
                  agents:
                    - agent-id-1
                    - agent-id-2
                  rollout_duration_seconds: 3600
                  version: '8.17.0'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - required:
                      - actionId
                    type: object
                    properties:
                      actionId:
                        type: string
                    additionalProperties: false
                  - required:
                      - count
                    type: object
                    properties:
                      count:
                        type: number
                    additionalProperties: false
              examples:
                postBulkUpgradeAgentsExample:
                  description: Bulk upgrade action result
                  value:
                    actionId: action-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/files/{fileId}':
    delete:
      tags:
        - Elastic Agents
      summary: Delete an uploaded file
      description: 'Delete a file uploaded by an agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: delete-fleet-agents-files-fileid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: fileId
          in: path
          description: The ID of the uploaded file
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                  - deleted
                type: object
                properties:
                  deleted:
                    type: boolean
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteAgentUploadFileExample:
                  description: Uploaded file successfully deleted
                  value:
                    deleted: true
                    id: file-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/agents/files/{fileId}/{fileName}':
    get:
      tags:
        - Elastic Agents
      summary: Get an uploaded file
      description: 'Get a file uploaded by an agent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-files-fileid-filename
      parameters:
        - name: fileId
          in: path
          description: The ID of the uploaded file
          required: true
          schema:
            type: string
        - name: fileName
          in: path
          description: The name of the uploaded file
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response — returns the uploaded file content
          content:
            application/json:
              schema:
                type: object
              examples:
                getAgentUploadFileExample:
                  description: The uploaded file content as a stream
                  value: <binary file content>
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/setup:
    get:
      tags:
        - Elastic Agents
      summary: Get agent setup info
      description: 'Get the current Fleet setup status, including whether Fleet is ready to enroll agents and which requirements or optional features are missing.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.'
      operationId: get-fleet-agents-setup
      responses:
        '200':
          description: Fleet setup status
          content:
            application/json:
              schema:
                required:
                  - isReady
                  - missing_requirements
                  - missing_optional_features
                type: object
                properties:
                  is_action_secrets_storage_enabled:
                    type: boolean
                  is_secrets_storage_enabled:
                    type: boolean
                  is_space_awareness_enabled:
                    type: boolean
                  is_ssl_secrets_storage_enabled:
                    type: boolean
                  isReady:
                    type: boolean
                  missing_optional_features:
                    maxItems: 1
                    type: array
                    items:
                      enum:
                        - encrypted_saved_object_encryption_key_required
                      type: string
                  missing_requirements:
                    maxItems: 5
                    type: array
                    items:
                      enum:
                        - security_required
                        - tls_required
                        - api_keys
                        - fleet_admin_user
                        - fleet_server
                      type: string
                  package_verification_key_id:
                    type: string
                additionalProperties: false
                description: 'A summary of the agent setup status. `isReady` indicates whether the setup is ready. If the setup is not ready, `missing_requirements` lists which requirements are missing.'
              examples:
                agentsSetupNotReadyExample:
                  description: Fleet is not ready — a Fleet Server and API keys are required
                  value:
                    is_action_secrets_storage_enabled: false
                    is_secrets_storage_enabled: false
                    is_space_awareness_enabled: false
                    is_ssl_secrets_storage_enabled: false
                    isReady: false
                    missing_optional_features:
                      - encrypted_saved_object_encryption_key_required
                    missing_requirements:
                      - fleet_server
                      - api_keys
                agentsSetupReadyExample:
                  description: Fleet is ready to enroll agents — all requirements are met
                  value:
                    is_action_secrets_storage_enabled: true
                    is_secrets_storage_enabled: true
                    is_space_awareness_enabled: false
                    is_ssl_secrets_storage_enabled: false
                    isReady: true
                    missing_optional_features: [ ]
                    missing_requirements: [ ]
                    package_verification_key_id: D88DB4CC
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Agents
      summary: Initiate Fleet setup
      description: 'Initialize Fleet. This endpoint is used by Elastic Agents to trigger Fleet setup. Safe to call multiple times; subsequent calls are idempotent.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.'
      operationId: post-fleet-agents-setup
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      responses:
        '200':
          description: Fleet setup completed
          content:
            application/json:
              schema:
                required:
                  - isInitialized
                  - nonFatalErrors
                type: object
                properties:
                  isInitialized:
                    type: boolean
                  nonFatalErrors:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - name
                        - message
                      type: object
                      properties:
                        message:
                          type: string
                        name:
                          type: string
                      additionalProperties: false
                additionalProperties: false
                description: 'A summary of the result of Fleet''s `setup` lifecycle. If `isInitialized` is true, Fleet is ready to accept agent enrollment. `nonFatalErrors` may include useful insight into non-blocking issues with Fleet setup.'
              examples:
                agentsSetupSuccessExample:
                  description: Fleet setup initialized successfully with no non-fatal errors
                  value:
                    isInitialized: true
                    nonFatalErrors: [ ]
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/agents/tags:
    get:
      tags:
        - Elastic Agents
      summary: Get agent tags
      description: 'Get a list of all tags used across enrolled agents.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read.'
      operationId: get-fleet-agents-tags
      parameters:
        - name: kuery
          in: query
          description: A KQL query string to filter results
          schema:
            type: string
        - name: showInactive
          in: query
          description: 'When true, include tags from inactive agents'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      type: string
                additionalProperties: false
              examples:
                getAgentTagsExample:
                  description: List of tags used across agents
                  value:
                    items:
                      - production
                      - linux
                      - datacenter-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/check-permissions:
    get:
      tags:
        - Fleet internals
      summary: Check permissions
      description: Check whether the current user has the required permissions to use Fleet. Optionally verifies Fleet Server setup privileges.
      operationId: get-fleet-check-permissions
      parameters:
        - name: fleetServerSetup
          in: query
          description: 'When true, check Fleet Server setup privileges in addition to standard Fleet privileges'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - success
                type: object
                properties:
                  error:
                    enum:
                      - MISSING_SECURITY
                      - MISSING_PRIVILEGES
                      - MISSING_FLEET_SERVER_SETUP_PRIVILEGES
                    type: string
                  success:
                    type: boolean
                additionalProperties: false
              examples:
                checkPermissionsMissingPrivilegesExample:
                  description: The current user is missing Fleet privileges
                  value:
                    error: MISSING_PRIVILEGES
                    success: false
                checkPermissionsSuccessExample:
                  description: The current user has all required Fleet permissions
                  value:
                    success: true
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_connectors:
    get:
      tags:
        - Fleet cloud connectors
      summary: Get cloud connectors
      description: 'List all Fleet cloud connectors.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.'
      operationId: get-fleet-cloud-connectors
      parameters:
        - name: page
          in: query
          description: The page number for pagination.
          schema:
            type: string
        - name: perPage
          in: query
          description: The number of items per page.
          schema:
            type: string
        - name: kuery
          in: query
          description: KQL query to filter cloud connectors.
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - name
                        - cloudProvider
                        - vars
                        - packagePolicyCount
                        - created_at
                        - updated_at
                      type: object
                      properties:
                        accountType:
                          type: string
                        cloudProvider:
                          type: string
                        created_at:
                          type: string
                        iac_blueprint_id:
                          maxLength: 255
                          minLength: 1
                          type:
                            - 'null'
                            - string
                          description: Identifier of the template source last used for this connector. Set to null to remove it.
                          x-state: Experimental; added in 9.6.0
                        iac_blueprint_version:
                          maxLength: 64
                          minLength: 1
                          type:
                            - 'null'
                            - string
                          description: Version of the template source last used for this connector. Set to null to remove it.
                          x-state: Experimental; added in 9.6.0
                        iac_deployment_id:
                          maxLength: 2048
                          minLength: 1
                          type: string
                          description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                          x-state: Experimental; added in 9.6.0
                        iac_key:
                          maxLength: 512
                          minLength: 1
                          type:
                            - 'null'
                            - string
                          description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                          x-state: Experimental; added in 9.6.0
                        iac_upgrade_checked_at:
                          type: string
                          description: When this connector was last checked for a CloudFormation template upgrade.
                          x-state: Experimental; added in 9.6.0
                        iac_upgrade_status:
                          enum:
                            - up_to_date
                            - upgrade_available
                          type: string
                          description: Whether a newer CloudFormation template is available for this connector.
                          x-state: Experimental; added in 9.6.0
                        id:
                          type: string
                        name:
                          type: string
                        namespace:
                          type: string
                        packagePolicyCount:
                          type: number
                        updated_at:
                          type: string
                        vars:
                          type: object
                          additionalProperties: { }
                        verification_failed_at:
                          type: string
                        verification_started_at:
                          type: string
                        verification_status:
                          type: string
                      additionalProperties: false
                additionalProperties: false
              examples:
                getCloudConnectorsExample:
                  description: List of Fleet cloud connectors
                  value:
                    items:
                      - accountType: single-account
                        cloudProvider: aws
                        created_at: '2024-01-15T10:00:00.000Z'
                        iac_blueprint_id: federated-identity
                        iac_blueprint_version: 1.0.0
                        iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                        iac_key: sha256:661cb7def1c7101f
                        iac_upgrade_checked_at: '2024-01-15T10:00:00.000Z'
                        iac_upgrade_status: up_to_date
                        id: cloud-connector-id-1
                        name: My AWS connector
                        packagePolicyCount: 2
                        updated_at: '2024-01-15T10:00:00.000Z'
                        vars: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet cloud connectors
      summary: Create cloud connector
      description: 'Create a new Fleet cloud connector.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.'
      operationId: post-fleet-cloud-connectors
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - cloudProvider
                - vars
              type: object
              properties:
                accountType:
                  enum:
                    - single-account
                    - organization-account
                  type: string
                  description: 'The account type: single-account (single account/subscription) or organization-account (organization-wide).'
                cloudProvider:
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
                  description: 'The cloud provider type: aws, azure, or gcp.'
                iac_blueprint_id:
                  maxLength: 255
                  minLength: 1
                  type:
                    - 'null'
                    - string
                  description: Identifier of the template source last used for this connector. Set to null to remove it.
                  x-state: Experimental; added in 9.6.0
                iac_blueprint_version:
                  maxLength: 64
                  minLength: 1
                  type:
                    - 'null'
                    - string
                  description: Version of the template source last used for this connector. Set to null to remove it.
                  x-state: Experimental; added in 9.6.0
                iac_deployment_id:
                  maxLength: 2048
                  minLength: 1
                  type: string
                  description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                  x-state: Experimental; added in 9.6.0
                iac_key:
                  maxLength: 512
                  minLength: 1
                  type:
                    - 'null'
                    - string
                  description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                  x-state: Experimental; added in 9.6.0
                name:
                  maxLength: 255
                  minLength: 1
                  type: string
                  description: The name of the cloud connector.
                vars:
                  type: object
                  additionalProperties:
                    anyOf:
                      - maxLength: 1000
                        type: string
                      - type: number
                      - type: boolean
                      - required:
                          - type
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            maxLength: 50
                            type: string
                          value:
                            anyOf:
                              - maxLength: 1000
                                type: string
                              - required:
                                  - isSecretRef
                                  - id
                                type: object
                                properties:
                                  id:
                                    maxLength: 255
                                    type: string
                                  isSecretRef:
                                    type: boolean
                                additionalProperties: false
                        additionalProperties: false
              additionalProperties: false
            examples:
              postCloudConnectorRequestExample:
                description: Create a new AWS cloud connector
                value:
                  accountType: single-account
                  cloudProvider: aws
                  iac_blueprint_id: federated-identity
                  iac_blueprint_version: 1.0.0
                  iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                  iac_key: sha256:661cb7def1c7101f
                  name: My AWS connector
                  vars: { }
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - name
                      - cloudProvider
                      - vars
                      - packagePolicyCount
                      - created_at
                      - updated_at
                    type: object
                    properties:
                      accountType:
                        type: string
                      cloudProvider:
                        type: string
                      created_at:
                        type: string
                      iac_blueprint_id:
                        maxLength: 255
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Identifier of the template source last used for this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_blueprint_version:
                        maxLength: 64
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Version of the template source last used for this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_deployment_id:
                        maxLength: 2048
                        minLength: 1
                        type: string
                        description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                        x-state: Experimental; added in 9.6.0
                      iac_key:
                        maxLength: 512
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_checked_at:
                        type: string
                        description: When this connector was last checked for a CloudFormation template upgrade.
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_status:
                        enum:
                          - up_to_date
                          - upgrade_available
                        type: string
                        description: Whether a newer CloudFormation template is available for this connector.
                        x-state: Experimental; added in 9.6.0
                      id:
                        type: string
                      name:
                        type: string
                      namespace:
                        type: string
                      packagePolicyCount:
                        type: number
                      updated_at:
                        type: string
                      vars:
                        type: object
                        additionalProperties: { }
                      verification_failed_at:
                        type: string
                      verification_started_at:
                        type: string
                      verification_status:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                postCloudConnectorExample:
                  description: The created Fleet cloud connector
                  value:
                    item:
                      accountType: single-account
                      cloudProvider: aws
                      created_at: '2024-01-15T10:00:00.000Z'
                      iac_blueprint_id: federated-identity
                      iac_blueprint_version: 1.0.0
                      iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                      iac_key: sha256:661cb7def1c7101f
                      iac_upgrade_checked_at: '2024-01-15T10:00:00.000Z'
                      iac_upgrade_status: up_to_date
                      id: cloud-connector-id-2
                      name: My AWS connector
                      packagePolicyCount: 0
                      updated_at: '2024-01-15T10:00:00.000Z'
                      vars: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/cloud_connectors/{cloudConnectorId}':
    delete:
      tags:
        - Fleet cloud connectors
      summary: Delete cloud connector (supports force deletion)
      description: 'Delete a cloud connector by ID. Use the `force` query parameter to delete even if package policies are still using it.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.'
      operationId: delete-fleet-cloud-connectors-cloudconnectorid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: cloudConnectorId
          in: path
          description: The unique identifier of the cloud connector to delete.
          required: true
          schema:
            type: string
        - name: force
          in: query
          description: 'If true, forces deletion even if the cloud connector is in use.'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteCloudConnectorExample:
                  description: The cloud connector was successfully deleted
                  value:
                    id: cloud-connector-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet cloud connectors
      summary: Get cloud connector
      description: 'Get a cloud connector by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.'
      operationId: get-fleet-cloud-connectors-cloudconnectorid
      parameters:
        - name: cloudConnectorId
          in: path
          description: The unique identifier of the cloud connector.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - name
                      - cloudProvider
                      - vars
                      - packagePolicyCount
                      - created_at
                      - updated_at
                    type: object
                    properties:
                      accountType:
                        type: string
                      cloudProvider:
                        type: string
                      created_at:
                        type: string
                      iac_blueprint_id:
                        maxLength: 255
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Identifier of the template source last used for this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_blueprint_version:
                        maxLength: 64
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Version of the template source last used for this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_deployment_id:
                        maxLength: 2048
                        minLength: 1
                        type: string
                        description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                        x-state: Experimental; added in 9.6.0
                      iac_key:
                        maxLength: 512
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_checked_at:
                        type: string
                        description: When this connector was last checked for a CloudFormation template upgrade.
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_status:
                        enum:
                          - up_to_date
                          - upgrade_available
                        type: string
                        description: Whether a newer CloudFormation template is available for this connector.
                        x-state: Experimental; added in 9.6.0
                      id:
                        type: string
                      name:
                        type: string
                      namespace:
                        type: string
                      packagePolicyCount:
                        type: number
                      updated_at:
                        type: string
                      vars:
                        type: object
                        additionalProperties: { }
                      verification_failed_at:
                        type: string
                      verification_started_at:
                        type: string
                      verification_status:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getCloudConnectorExample:
                  description: A Fleet cloud connector
                  value:
                    item:
                      accountType: single-account
                      cloudProvider: aws
                      created_at: '2024-01-15T10:00:00.000Z'
                      iac_blueprint_id: federated-identity
                      iac_blueprint_version: 1.0.0
                      iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                      iac_key: sha256:661cb7def1c7101f
                      iac_upgrade_checked_at: '2024-01-15T10:00:00.000Z'
                      iac_upgrade_status: up_to_date
                      id: cloud-connector-id-1
                      name: My AWS connector
                      packagePolicyCount: 2
                      updated_at: '2024-01-15T10:00:00.000Z'
                      vars: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet cloud connectors
      summary: Update cloud connector
      description: 'Update a cloud connector by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.'
      operationId: put-fleet-cloud-connectors-cloudconnectorid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: cloudConnectorId
          in: path
          description: The unique identifier of the cloud connector to update.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                accountType:
                  enum:
                    - single-account
                    - organization-account
                  type: string
                  description: 'The account type: single-account (single account/subscription) or organization-account (organization-wide).'
                iac_blueprint_id:
                  maxLength: 255
                  minLength: 1
                  type:
                    - 'null'
                    - string
                  description: Identifier of the template source last used for this connector. Set to null to remove it.
                  x-state: Experimental; added in 9.6.0
                iac_blueprint_version:
                  maxLength: 64
                  minLength: 1
                  type:
                    - 'null'
                    - string
                  description: Version of the template source last used for this connector. Set to null to remove it.
                  x-state: Experimental; added in 9.6.0
                iac_deployment_id:
                  maxLength: 2048
                  minLength: 1
                  type: string
                  description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                  x-state: Experimental; added in 9.6.0
                iac_key:
                  maxLength: 512
                  minLength: 1
                  type:
                    - 'null'
                    - string
                  description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                  x-state: Experimental; added in 9.6.0
                name:
                  maxLength: 255
                  minLength: 1
                  type: string
                  description: The name of the cloud connector.
                vars:
                  type: object
                  additionalProperties:
                    anyOf:
                      - maxLength: 1000
                        type: string
                      - type: number
                      - type: boolean
                      - required:
                          - type
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            maxLength: 50
                            type: string
                          value:
                            anyOf:
                              - maxLength: 1000
                                type: string
                              - required:
                                  - isSecretRef
                                  - id
                                type: object
                                properties:
                                  id:
                                    maxLength: 255
                                    type: string
                                  isSecretRef:
                                    type: boolean
                                additionalProperties: false
                        additionalProperties: false
              additionalProperties: false
            examples:
              putCloudConnectorRequestExample:
                description: Update a Fleet cloud connector
                value:
                  iac_blueprint_id: federated-identity
                  iac_blueprint_version: 1.0.0
                  iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                  iac_key: sha256:661cb7def1c7101f
                  name: Updated AWS connector
                  vars: { }
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - name
                      - cloudProvider
                      - vars
                      - packagePolicyCount
                      - created_at
                      - updated_at
                    type: object
                    properties:
                      accountType:
                        type: string
                      cloudProvider:
                        type: string
                      created_at:
                        type: string
                      iac_blueprint_id:
                        maxLength: 255
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Identifier of the template source last used for this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_blueprint_version:
                        maxLength: 64
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Version of the template source last used for this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_deployment_id:
                        maxLength: 2048
                        minLength: 1
                        type: string
                        description: ARN of the last CloudFormation stack deployed for this connector (`arn:<partition>:cloudformation:<region>:<account>:stack/<name>/<id>`).
                        x-state: Experimental; added in 9.6.0
                      iac_key:
                        maxLength: 512
                        minLength: 1
                        type:
                          - 'null'
                          - string
                        description: Checksum of the CloudFormation template last saved on this connector. Set to null to remove it.
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_checked_at:
                        type: string
                        description: When this connector was last checked for a CloudFormation template upgrade.
                        x-state: Experimental; added in 9.6.0
                      iac_upgrade_status:
                        enum:
                          - up_to_date
                          - upgrade_available
                        type: string
                        description: Whether a newer CloudFormation template is available for this connector.
                        x-state: Experimental; added in 9.6.0
                      id:
                        type: string
                      name:
                        type: string
                      namespace:
                        type: string
                      packagePolicyCount:
                        type: number
                      updated_at:
                        type: string
                      vars:
                        type: object
                        additionalProperties: { }
                      verification_failed_at:
                        type: string
                      verification_started_at:
                        type: string
                      verification_status:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                putCloudConnectorExample:
                  description: The updated Fleet cloud connector
                  value:
                    item:
                      accountType: single-account
                      cloudProvider: aws
                      created_at: '2024-01-15T10:00:00.000Z'
                      iac_blueprint_id: federated-identity
                      iac_blueprint_version: 1.0.0
                      iac_deployment_id: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-connector/abc
                      iac_key: sha256:661cb7def1c7101f
                      iac_upgrade_checked_at: '2024-01-15T11:00:00.000Z'
                      iac_upgrade_status: up_to_date
                      id: cloud-connector-id-1
                      name: Updated AWS connector
                      packagePolicyCount: 2
                      updated_at: '2024-01-15T11:00:00.000Z'
                      vars: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/cloud_connectors/{cloudConnectorId}/usage':
    get:
      tags:
        - Fleet cloud connectors
      summary: Get cloud connector usage (package policies using the connector)
      description: 'Get a list of package policies that are using a given cloud connector.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.'
      operationId: get-fleet-cloud-connectors-cloudconnectorid-usage
      parameters:
        - name: cloudConnectorId
          in: path
          description: The unique identifier of the cloud connector.
          required: true
          schema:
            type: string
        - name: page
          in: query
          description: The page number for pagination.
          schema:
            minimum: 1
            type: number
        - name: perPage
          in: query
          description: The number of items per page.
          schema:
            minimum: 1
            type: number
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - name
                        - policy_ids
                        - created_at
                        - updated_at
                      type: object
                      properties:
                        created_at:
                          type: string
                        id:
                          type: string
                        name:
                          type: string
                        package:
                          required:
                            - name
                            - title
                            - version
                          type: object
                          properties:
                            name:
                              type: string
                            title:
                              type: string
                            version:
                              type: string
                          additionalProperties: false
                        policy_ids:
                          maxItems: 10000
                          type: array
                          items:
                            type: string
                        updated_at:
                          type: string
                      additionalProperties: false
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getCloudConnectorUsageResponseExample:
                  description: Example response showing package policies using the cloud connector
                  value:
                    items:
                      - created_at: '2025-01-16T09:00:00.000Z'
                        id: package-policy-1
                        name: CSPM AWS Policy
                        package:
                          name: cloud_security_posture
                          title: Cloud Security Posture Management
                          version: '3.1.1'
                        policy_ids:
                          - policy-id-123
                          - policy-id-456
                        updated_at: '2025-01-16T09:00:00.000Z'
                    page: 1
                    perPage: 20
                    total: 2
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: Cloud connector not found
                    statusCode: 400
      x-state: Experimental; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/cloud_onboarding_deployments:
    post:
      tags:
        - Fleet cloud onboarding deployments
      summary: Create cloud onboarding deployment
      description: 'Create a new Fleet cloud onboarding deployment.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.'
      operationId: post-fleet-cloud-onboarding-deployments
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - provider
                - mechanisms
                - services
              type: object
              properties:
                authMethod:
                  enum:
                    - identity_federation
                    - static_keys
                  type: string
                  description: Authentication method for managed integrations.
                connectorId:
                  maxLength: 255
                  minLength: 1
                  type: string
                  description: ID of the fleet-cloud-connector to associate with this deployment. Omit for static-keys deployments.
                dataFormat:
                  enum:
                    - ecs
                    - otel
                  type: string
                  description: 'Data format: ecs or otel.'
                globalRegion:
                  maxLength: 64
                  type: string
                  description: Global AWS region from the Service Settings step.
                mechanisms:
                  maxItems: 10
                  type: array
                  items:
                    enum:
                      - managed_integration
                      - ecf
                      - agent_based
                    type: string
                    description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                  description: Delivery mechanisms active in this deployment.
                provider:
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
                  description: Cloud provider.
                services:
                  maxItems: 1000
                  minItems: 1
                  type: array
                  items:
                    minLength: 1
                    type: string
                  description: Service IDs to be covered by this deployment.
                serviceVars:
                  type: object
                  additionalProperties:
                    type: object
                    additionalProperties: { }
                  description: Per-service config keyed by instance ID.
              additionalProperties: false
            examples:
              postCloudOnboardingDeploymentAgentBasedRequestExample:
                description: Create a new AWS cloud onboarding deployment using an Elastic Agent (agent-based)
                value:
                  connectorId: cloud-connector-id-1
                  mechanisms:
                    - agent_based
                  provider: aws
                  services:
                    - cloudwatch_metrics
                  serviceVars:
                    cloudwatch_metrics:
                      namespace: AWS/EC2
                      regions:
                        - us-east-1
              postCloudOnboardingDeploymentEcfRequestExample:
                description: Create a new AWS cloud onboarding deployment using Elastic Cloud Forwarder (ECF)
                value:
                  connectorId: cloud-connector-id-1
                  mechanisms:
                    - ecf
                  provider: aws
                  services:
                    - cloudfront_logs
                  serviceVars:
                    cloudfront_logs:
                      regions:
                        - us-east-1
                      s3_bucket_arn: arn:aws:s3:::my-cloudfront-bucket
              postCloudOnboardingDeploymentRequestExample:
                description: Create a new AWS cloud onboarding deployment using identity federation (managed integration)
                value:
                  connectorId: cloud-connector-id-1
                  mechanisms:
                    - managed_integration
                  provider: aws
                  services:
                    - cloudwatch_metrics
                    - cloudtrail
                  serviceVars:
                    cloudtrail:
                      regions:
                        - us-east-1
                      s3_bucket_arn: arn:aws:s3:::my-cloudtrail-bucket
                    cloudwatch_metrics:
                      namespace: AWS/EC2
                      regions:
                        - us-east-1
                        - eu-west-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - provider
                      - mechanisms
                      - services
                      - status
                      - attemptCount
                    type: object
                    properties:
                      agentPolicyId:
                        type: string
                        description: Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.
                      apiKeyId:
                        type: string
                        description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                      attemptCount:
                        minimum: 1
                        type: number
                        description: 'Number of deployment attempts, including the current one.'
                      authMethod:
                        enum:
                          - identity_federation
                          - static_keys
                        type: string
                        description: Authentication method for managed integrations.
                      connectorId:
                        type: string
                        description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                      dataFormat:
                        enum:
                          - ecs
                          - otel
                        type: string
                        description: 'Data format: ecs or otel.'
                      deploymentId:
                        type: string
                        description: 'Opaque deployment identifier; for AWS, the CFN stack ARN.'
                      deploymentName:
                        type: string
                        description: 'Opaque deployment name; for AWS, the CFN stack name.'
                      ecfStacks:
                        maxItems: 10
                        type: array
                        items:
                          required:
                            - family
                            - stackName
                            - templateVersion
                          type: object
                          properties:
                            family:
                              enum:
                                - unified
                                - otel
                                - crowdstrike
                              type: string
                              description: ECF template family.
                            stackName:
                              maxLength: 128
                              minLength: 1
                              type: string
                              description: CloudFormation stack name (128-char AWS limit).
                            templateVersion:
                              maxLength: 32
                              minLength: 1
                              type: string
                              description: 'ECF semantic version resolved at launch time, e.g. "1.10.0".'
                          additionalProperties: false
                        description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                      globalRegion:
                        type: string
                        description: Global AWS region from the Service Settings step.
                      id:
                        type: string
                      mechanisms:
                        maxItems: 10
                        type: array
                        items:
                          enum:
                            - managed_integration
                            - ecf
                            - agent_based
                          type: string
                          description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                      packagePolicyIds:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                        description: Package policy IDs created for managed_integration services.
                      provider:
                        enum:
                          - aws
                          - azure
                          - gcp
                        type: string
                        description: Cloud provider.
                      services:
                        maxItems: 1000
                        type: array
                        items:
                          type: string
                        description: Service IDs covered by this deployment.
                      serviceVars:
                        type: object
                        additionalProperties:
                          type: object
                          additionalProperties: { }
                        description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                      status:
                        enum:
                          - pending
                          - deploying
                          - succeeded
                          - failed
                        type: string
                        description: Deployment status.
                      statusMessage:
                        type: string
                        description: Error context when status is failed.
                    additionalProperties: false
                additionalProperties: false
              examples:
                postCloudOnboardingDeploymentAgentBasedExample:
                  description: Agent-based deployment — agentPolicyId set after the agent policy is selected or created
                  value:
                    item:
                      agentPolicyId: agent-policy-id-1
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      id: onboarding-deployment-id-2
                      mechanisms:
                        - agent_based
                      provider: aws
                      services:
                        - cloudwatch_metrics
                      serviceVars:
                        cloudwatch_metrics:
                          namespace: AWS/EC2
                          regions:
                            - us-east-1
                      status: pending
                postCloudOnboardingDeploymentEcfExample:
                  description: ECF deployment — apiKeyId set after the Elasticsearch API key is created for the ECF service
                  value:
                    item:
                      apiKeyId: es-api-key-id-1
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      id: onboarding-deployment-id-3
                      mechanisms:
                        - ecf
                      provider: aws
                      services:
                        - cloudfront_logs
                      serviceVars:
                        cloudfront_logs:
                          regions:
                            - us-east-1
                          s3_bucket_arn: arn:aws:s3:::my-cloudfront-bucket
                      status: pending
                postCloudOnboardingDeploymentExample:
                  description: Managed integration deployment — packagePolicyIds set after deployment completes
                  value:
                    item:
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      id: onboarding-deployment-id-1
                      mechanisms:
                        - managed_integration
                      packagePolicyIds:
                        - package-policy-id-1
                      provider: aws
                      services:
                        - cloudwatch_metrics
                        - cloudtrail
                      serviceVars:
                        cloudtrail:
                          regions:
                            - us-east-1
                          s3_bucket_arn: arn:aws:s3:::my-cloudtrail-bucket
                        cloudwatch_metrics:
                          namespace: AWS/EC2
                          regions:
                            - us-east-1
                            - eu-west-1
                      status: pending
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/cloud_onboarding_deployments/{id}':
    delete:
      tags:
        - Fleet cloud onboarding deployments
      summary: Delete cloud onboarding deployment
      description: 'Delete a cloud onboarding deployment by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.'
      operationId: delete-fleet-cloud-onboarding-deployments-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The saved object ID of the cloud onboarding deployment.
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteCloudOnboardingDeploymentExample:
                  description: The cloud onboarding deployment was successfully deleted
                  value:
                    id: onboarding-deployment-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundResponseExample:
                  description: The requested cloud onboarding deployment does not exist
                  value:
                    error: Not Found
                    message: 'Saved object [fleet-cloud-onboarding-deployment/unknown-id] not found'
                    statusCode: 404
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet cloud onboarding deployments
      summary: Get cloud onboarding deployment
      description: 'Get a cloud onboarding deployment by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.'
      operationId: get-fleet-cloud-onboarding-deployments-id
      parameters:
        - name: id
          in: path
          description: The saved object ID of the cloud onboarding deployment.
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - provider
                      - mechanisms
                      - services
                      - status
                      - attemptCount
                    type: object
                    properties:
                      agentPolicyId:
                        type: string
                        description: Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.
                      apiKeyId:
                        type: string
                        description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                      attemptCount:
                        minimum: 1
                        type: number
                        description: 'Number of deployment attempts, including the current one.'
                      authMethod:
                        enum:
                          - identity_federation
                          - static_keys
                        type: string
                        description: Authentication method for managed integrations.
                      connectorId:
                        type: string
                        description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                      dataFormat:
                        enum:
                          - ecs
                          - otel
                        type: string
                        description: 'Data format: ecs or otel.'
                      deploymentId:
                        type: string
                        description: 'Opaque deployment identifier; for AWS, the CFN stack ARN.'
                      deploymentName:
                        type: string
                        description: 'Opaque deployment name; for AWS, the CFN stack name.'
                      ecfStacks:
                        maxItems: 10
                        type: array
                        items:
                          required:
                            - family
                            - stackName
                            - templateVersion
                          type: object
                          properties:
                            family:
                              enum:
                                - unified
                                - otel
                                - crowdstrike
                              type: string
                              description: ECF template family.
                            stackName:
                              maxLength: 128
                              minLength: 1
                              type: string
                              description: CloudFormation stack name (128-char AWS limit).
                            templateVersion:
                              maxLength: 32
                              minLength: 1
                              type: string
                              description: 'ECF semantic version resolved at launch time, e.g. "1.10.0".'
                          additionalProperties: false
                        description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                      globalRegion:
                        type: string
                        description: Global AWS region from the Service Settings step.
                      id:
                        type: string
                      mechanisms:
                        maxItems: 10
                        type: array
                        items:
                          enum:
                            - managed_integration
                            - ecf
                            - agent_based
                          type: string
                          description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                      packagePolicyIds:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                        description: Package policy IDs created for managed_integration services.
                      provider:
                        enum:
                          - aws
                          - azure
                          - gcp
                        type: string
                        description: Cloud provider.
                      services:
                        maxItems: 1000
                        type: array
                        items:
                          type: string
                        description: Service IDs covered by this deployment.
                      serviceVars:
                        type: object
                        additionalProperties:
                          type: object
                          additionalProperties: { }
                        description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                      status:
                        enum:
                          - pending
                          - deploying
                          - succeeded
                          - failed
                        type: string
                        description: Deployment status.
                      statusMessage:
                        type: string
                        description: Error context when status is failed.
                    additionalProperties: false
                additionalProperties: false
              examples:
                getCloudOnboardingDeploymentExample:
                  description: A cloud onboarding deployment that has succeeded
                  value:
                    item:
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                      deploymentName: elastic-aws-onboarding
                      id: onboarding-deployment-id-1
                      mechanisms:
                        - managed_integration
                      packagePolicyIds:
                        - package-policy-id-1
                      provider: aws
                      services:
                        - cloudwatch_metrics
                        - cloudtrail
                      serviceVars:
                        cloudtrail:
                          - regions:
                              - us-east-1
                            s3_bucket_arn: arn:aws:s3:::my-cloudtrail-bucket
                        cloudwatch_metrics:
                          - namespace: AWS/EC2
                            regions:
                              - us-east-1
                              - eu-west-1
                      status: succeeded
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundResponseExample:
                  description: The requested cloud onboarding deployment does not exist
                  value:
                    error: Not Found
                    message: 'Saved object [fleet-cloud-onboarding-deployment/unknown-id] not found'
                    statusCode: 404
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet cloud onboarding deployments
      summary: Update cloud onboarding deployment
      description: 'Update a cloud onboarding deployment by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all OR integrations-all.'
      operationId: put-fleet-cloud-onboarding-deployments-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The saved object ID of the cloud onboarding deployment.
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                agentPolicyId:
                  maxLength: 255
                  type: string
                apiKeyId:
                  maxLength: 255
                  type: string
                attemptCount:
                  minimum: 1
                  type: number
                  description: Incremented by callers performing a retry.
                deploymentId:
                  maxLength: 2048
                  type: string
                  description: CFN stack ARN (or equivalent); provided by the client after manual deployment.
                deploymentName:
                  maxLength: 255
                  type: string
                ecfStacks:
                  maxItems: 10
                  type: array
                  items:
                    required:
                      - family
                      - stackName
                      - templateVersion
                    type: object
                    properties:
                      family:
                        enum:
                          - unified
                          - otel
                          - crowdstrike
                        type: string
                        description: ECF template family.
                      stackName:
                        maxLength: 128
                        minLength: 1
                        type: string
                        description: CloudFormation stack name (128-char AWS limit).
                      templateVersion:
                        maxLength: 32
                        minLength: 1
                        type: string
                        description: 'ECF semantic version resolved at launch time, e.g. "1.10.0".'
                    additionalProperties: false
                  description: ECF CloudFormation stacks to record for this deployment.
                packagePolicyIds:
                  maxItems: 100
                  type: array
                  items:
                    maxLength: 255
                    type: string
                serviceVars:
                  type: object
                  additionalProperties:
                    type: object
                    additionalProperties: { }
                  description: Per-service config keyed by instance ID.
                status:
                  enum:
                    - pending
                    - deploying
                    - succeeded
                    - failed
                  type: string
                  description: Deployment status.
                statusMessage:
                  maxLength: 1000
                  type: string
                  description: Error context; set when transitioning to failed.
              additionalProperties: false
            examples:
              putCloudOnboardingDeploymentRequestExample:
                description: Update a cloud onboarding deployment after the CFN stack has been submitted
                value:
                  deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                  deploymentName: elastic-aws-onboarding
                  status: deploying
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - provider
                      - mechanisms
                      - services
                      - status
                      - attemptCount
                    type: object
                    properties:
                      agentPolicyId:
                        type: string
                        description: Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.
                      apiKeyId:
                        type: string
                        description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                      attemptCount:
                        minimum: 1
                        type: number
                        description: 'Number of deployment attempts, including the current one.'
                      authMethod:
                        enum:
                          - identity_federation
                          - static_keys
                        type: string
                        description: Authentication method for managed integrations.
                      connectorId:
                        type: string
                        description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                      dataFormat:
                        enum:
                          - ecs
                          - otel
                        type: string
                        description: 'Data format: ecs or otel.'
                      deploymentId:
                        type: string
                        description: 'Opaque deployment identifier; for AWS, the CFN stack ARN.'
                      deploymentName:
                        type: string
                        description: 'Opaque deployment name; for AWS, the CFN stack name.'
                      ecfStacks:
                        maxItems: 10
                        type: array
                        items:
                          required:
                            - family
                            - stackName
                            - templateVersion
                          type: object
                          properties:
                            family:
                              enum:
                                - unified
                                - otel
                                - crowdstrike
                              type: string
                              description: ECF template family.
                            stackName:
                              maxLength: 128
                              minLength: 1
                              type: string
                              description: CloudFormation stack name (128-char AWS limit).
                            templateVersion:
                              maxLength: 32
                              minLength: 1
                              type: string
                              description: 'ECF semantic version resolved at launch time, e.g. "1.10.0".'
                          additionalProperties: false
                        description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                      globalRegion:
                        type: string
                        description: Global AWS region from the Service Settings step.
                      id:
                        type: string
                      mechanisms:
                        maxItems: 10
                        type: array
                        items:
                          enum:
                            - managed_integration
                            - ecf
                            - agent_based
                          type: string
                          description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                      packagePolicyIds:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                        description: Package policy IDs created for managed_integration services.
                      provider:
                        enum:
                          - aws
                          - azure
                          - gcp
                        type: string
                        description: Cloud provider.
                      services:
                        maxItems: 1000
                        type: array
                        items:
                          type: string
                        description: Service IDs covered by this deployment.
                      serviceVars:
                        type: object
                        additionalProperties:
                          type: object
                          additionalProperties: { }
                        description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                      status:
                        enum:
                          - pending
                          - deploying
                          - succeeded
                          - failed
                        type: string
                        description: Deployment status.
                      statusMessage:
                        type: string
                        description: Error context when status is failed.
                    additionalProperties: false
                additionalProperties: false
              examples:
                putCloudOnboardingDeploymentExample:
                  description: The updated cloud onboarding deployment
                  value:
                    item:
                      attemptCount: 1
                      connectorId: cloud-connector-id-1
                      deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                      deploymentName: elastic-aws-onboarding
                      id: onboarding-deployment-id-1
                      mechanisms:
                        - managed_integration
                      packagePolicyIds:
                        - package-policy-id-1
                      provider: aws
                      services:
                        - cloudwatch_metrics
                        - cloudtrail
                      status: deploying
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundResponseExample:
                  description: The requested cloud onboarding deployment does not exist
                  value:
                    error: Not Found
                    message: 'Saved object [fleet-cloud-onboarding-deployment/unknown-id] not found'
                    statusCode: 404
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/cloud_onboarding_deployments/connector/{connectorId}':
    get:
      tags:
        - Fleet cloud onboarding deployments
      summary: Get cloud onboarding deployments by connector ID
      description: 'List all cloud onboarding deployments for a given connector ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR integrations-read.'
      operationId: get-fleet-cloud-onboarding-deployments-connector-connectorid
      parameters:
        - name: connectorId
          in: path
          description: The fleet-cloud-connector ID to list deployments for.
          required: true
          schema:
            minLength: 1
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                type: object
                properties:
                  items:
                    maxItems: 100
                    type: array
                    items:
                      required:
                        - id
                        - provider
                        - mechanisms
                        - services
                        - status
                        - attemptCount
                      type: object
                      properties:
                        agentPolicyId:
                          type: string
                          description: Agent policy ID created for agent-based deployments. Present only when agent_based is in mechanisms.
                        apiKeyId:
                          type: string
                          description: Elasticsearch API key ID for push mechanisms (ecf). Set by the backend; used for key rotation/revocation.
                        attemptCount:
                          minimum: 1
                          type: number
                          description: 'Number of deployment attempts, including the current one.'
                        authMethod:
                          enum:
                            - identity_federation
                            - static_keys
                          type: string
                          description: Authentication method for managed integrations.
                        connectorId:
                          type: string
                          description: ID of the fleet-cloud-connector this deployment belongs to. Absent for static-keys deployments.
                        dataFormat:
                          enum:
                            - ecs
                            - otel
                          type: string
                          description: 'Data format: ecs or otel.'
                        deploymentId:
                          type: string
                          description: 'Opaque deployment identifier; for AWS, the CFN stack ARN.'
                        deploymentName:
                          type: string
                          description: 'Opaque deployment name; for AWS, the CFN stack name.'
                        ecfStacks:
                          maxItems: 10
                          type: array
                          items:
                            required:
                              - family
                              - stackName
                              - templateVersion
                            type: object
                            properties:
                              family:
                                enum:
                                  - unified
                                  - otel
                                  - crowdstrike
                                type: string
                                description: ECF template family.
                              stackName:
                                maxLength: 128
                                minLength: 1
                                type: string
                                description: CloudFormation stack name (128-char AWS limit).
                              templateVersion:
                                maxLength: 32
                                minLength: 1
                                type: string
                                description: 'ECF semantic version resolved at launch time, e.g. "1.10.0".'
                            additionalProperties: false
                          description: ECF CloudFormation stacks launched as part of this deployment. Written by the wizard after the user clicks Launch.
                        globalRegion:
                          type: string
                          description: Global AWS region from the Service Settings step.
                        id:
                          type: string
                        mechanisms:
                          maxItems: 10
                          type: array
                          items:
                            enum:
                              - managed_integration
                              - ecf
                              - agent_based
                            type: string
                            description: 'Delivery mechanism: managed_integration, ecf, or agent_based.'
                        packagePolicyIds:
                          maxItems: 100
                          type: array
                          items:
                            type: string
                          description: Package policy IDs created for managed_integration services.
                        provider:
                          enum:
                            - aws
                            - azure
                            - gcp
                          type: string
                          description: Cloud provider.
                        services:
                          maxItems: 1000
                          type: array
                          items:
                            type: string
                          description: Service IDs covered by this deployment.
                        serviceVars:
                          type: object
                          additionalProperties:
                            type: object
                            additionalProperties: { }
                          description: Per-service config keyed by instance ID. Each value is the ServiceVars object from the Service Settings step.
                        status:
                          enum:
                            - pending
                            - deploying
                            - succeeded
                            - failed
                          type: string
                          description: Deployment status.
                        statusMessage:
                          type: string
                          description: Error context when status is failed.
                      additionalProperties: false
                additionalProperties: false
              examples:
                getCloudOnboardingDeploymentsByConnectorIdExample:
                  description: List of cloud onboarding deployments for a connector
                  value:
                    items:
                      - attemptCount: 1
                        connectorId: cloud-connector-id-1
                        deploymentId: arn:aws:cloudformation:us-east-1:123456789012:stack/elastic-aws-onboarding/aaa-bbb-ccc
                        deploymentName: elastic-aws-onboarding
                        id: onboarding-deployment-id-1
                        mechanisms:
                          - managed_integration
                        packagePolicyIds:
                          - package-policy-id-1
                        provider: aws
                        services:
                          - cloudwatch_metrics
                        status: succeeded
                      - attemptCount: 1
                        connectorId: cloud-connector-id-1
                        id: onboarding-deployment-id-2
                        mechanisms:
                          - managed_integration
                          - ecf
                        provider: aws
                        services:
                          - cloudfront_logs
                        serviceVars:
                          cloudfront_logs:
                            regions:
                              - us-east-1
                            s3_bucket_arn: arn:aws:s3:::my-cloudfront-logs-bucket
                        status: deploying
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/data_streams:
    get:
      tags:
        - Data streams
      summary: Get data streams
      description: 'List all Fleet-managed data streams with metadata including package, namespace, size, and last activity.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.'
      operationId: get-fleet-data-streams
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - data_streams
                type: object
                properties:
                  data_streams:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - index
                        - dataset
                        - namespace
                        - type
                        - package
                        - package_version
                        - last_activity_ms
                        - size_in_bytes
                        - size_in_bytes_formatted
                        - dashboards
                      type: object
                      properties:
                        dashboards:
                          maxItems: 10000
                          type: array
                          items:
                            required:
                              - id
                              - title
                            type: object
                            properties:
                              id:
                                type: string
                              title:
                                type: string
                            additionalProperties: false
                        dataset:
                          type: string
                        index:
                          type: string
                        last_activity_ms:
                          type: number
                        namespace:
                          type: string
                        package:
                          type: string
                        package_version:
                          type: string
                        serviceDetails:
                          required:
                            - environment
                            - serviceName
                          type:
                            - 'null'
                            - object
                          properties:
                            environment:
                              type: string
                            serviceName:
                              type: string
                          additionalProperties: false
                          default: 'null'
                        size_in_bytes:
                          type: number
                        size_in_bytes_formatted:
                          type:
                            - number
                            - string
                        type:
                          type: string
                      additionalProperties: false
                additionalProperties: false
              examples:
                getDataStreamsExample:
                  description: List of Fleet-managed data streams
                  value:
                    data_streams:
                      - dashboards:
                          - id: nginx-overview
                            title: Nginx Overview
                        dataset: nginx.access
                        index: logs-nginx.access-default
                        last_activity_ms: 1700000000000
                        namespace: default
                        package: nginx
                        package_version: '1.20.0'
                        serviceDetails: 'null'
                        size_in_bytes: 1048576
                        size_in_bytes_formatted: 1mb
                        type: logs
                      - dashboards: [ ]
                        dataset: system.cpu
                        index: metrics-system.cpu-default
                        last_activity_ms: 1699999000000
                        namespace: default
                        package: system
                        package_version: 1.38.0
                        serviceDetails: 'null'
                        size_in_bytes: 524288
                        size_in_bytes_formatted: 512kb
                        type: metrics
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/data_streams/data:
    get:
      tags:
        - Data streams
      summary: Check if data streams have data
      description: 'Check whether one or more data stream index patterns contain any documents indexed at or after the given start time.<br/><br/>[Required authorization] Route required privileges: fleet-read.'
      operationId: get-fleet-data-streams-data
      parameters:
        - name: dataStreams
          in: query
          description: A comma-separated list of data stream index patterns to check. Each pattern must be of the form `logs-<dataset>-*` or `metrics-<dataset>-*`.
          required: true
          schema:
            maxLength: 4096
            type: string
        - name: start
          in: query
          description: An ISO 8601 timestamp. Only documents with an `@timestamp` at or after this time are considered.
          required: true
          schema:
            maxLength: 64
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - results
                type: object
                properties:
                  results:
                    type: object
                    additionalProperties:
                      type: boolean
                    description: 'One entry per requested index pattern. `true` when the pattern matched at least one document, `false` when it matched none or the pattern resolved to no index.'
                additionalProperties: false
              examples:
                getDataStreamsHasDataExample:
                  description: One entry per requested index pattern
                  value:
                    results:
                      logs-aws.cloudtrail-*: true
                      metrics-aws.ec2-*: false
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                getDataStreamsHasDataInvalidPatternExample:
                  description: A requested pattern is not a supported data stream wildcard
                  value:
                    error: Bad Request
                    message: 'Invalid index pattern: ".security-7"'
                    statusCode: 400
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/enrollment_api_keys:
    get:
      tags:
        - Fleet enrollment API keys
      summary: Get enrollment API keys
      description: 'List all enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.'
      operationId: get-fleet-enrollment-api-keys
      parameters:
        - name: page
          in: query
          description: Page number
          schema:
            type: number
            default: 1
        - name: perPage
          in: query
          description: Number of results per page
          schema:
            type: number
            default: 20
        - name: kuery
          in: query
          description: A KQL query string to filter results
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_enrollment_api_keys_response'
              examples:
                getEnrollmentApiKeysExample:
                  description: List of enrollment API keys
                  value:
                    items:
                      - active: true
                        api_key: api-key-value-1
                        api_key_id: api-key-id-1
                        created_at: '2024-01-01T00:00:00.000Z'
                        id: key-id-1
                        name: Default policy enrollment key
                        policy_id: policy-id-1
                    list:
                      - active: true
                        api_key: api-key-value-1
                        api_key_id: api-key-id-1
                        created_at: '2024-01-01T00:00:00.000Z'
                        id: key-id-1
                        name: Default policy enrollment key
                        policy_id: policy-id-1
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet enrollment API keys
      summary: Create an enrollment API key
      description: 'Create an enrollment API key for a given agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-enrollment-api-keys
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_enrollment_api_key'
            examples:
              postEnrollmentApiKeyRequestExample:
                description: Create an enrollment API key for an agent policy
                value:
                  expiration: '2025-01-01T00:00:00.000Z'
                  name: My enrollment key
                  policy_id: policy-id-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_create_enrollment_api_key_response'
              examples:
                postEnrollmentApiKeyExample:
                  description: The created enrollment API key
                  value:
                    action: created
                    item:
                      active: true
                      api_key: api-key-value-1
                      api_key_id: api-key-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: key-id-1
                      name: My enrollment key
                      policy_id: policy-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/enrollment_api_keys/_bulk_delete:
    post:
      tags:
        - Fleet enrollment API keys
      summary: Bulk revoke or delete enrollment API keys
      description: 'Revoke or delete multiple enrollment API keys.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-enrollment-api-keys-bulk-delete
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_request'
            examples:
              bulkDeleteByIdsExample:
                description: Bulk delete enrollment API keys by IDs
                value:
                  forceDelete: true
                  tokenIds:
                    - token-id-1
                    - token-id-2
              bulkDeleteByKueryExample:
                description: Bulk delete enrollment API keys by KQL query
                value:
                  forceDelete: false
                  kuery: policy_id:"policy-id-1"
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_response'
              examples:
                bulkDeleteEnrollmentApiKeysExample:
                  description: The enrollment API keys were successfully processed
                  value:
                    action: deleted
                    count: 2
                    errorCount: 0
                    successCount: 2
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: Either tokenIds or kuery must be provided
                    statusCode: 400
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/enrollment_api_keys/{keyId}':
    delete:
      tags:
        - Fleet enrollment API keys
      summary: Revoke or delete an enrollment API key
      description: 'Revoke or delete an enrollment API key by ID. Use `forceDelete=true` to remove the document.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: delete-fleet-enrollment-api-keys-keyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: keyId
          in: path
          description: The ID of the enrollment API key
          required: true
          schema:
            type: string
        - name: forceDelete
          in: query
          description: 'When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.'
          schema:
            type: boolean
            default: false
        - name: includeHidden
          in: query
          description: 'When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_enrollment_api_key_response'
              examples:
                deleteEnrollmentApiKeyExample:
                  description: The enrollment API key was successfully revoked
                  value:
                    action: deleted
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No enrollment API key was found with the given ID
                  value:
                    error: Not Found
                    message: EnrollmentAPIKey key-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet enrollment API keys
      summary: Get an enrollment API key
      description: 'Get an enrollment API key by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all OR fleet-setup.'
      operationId: get-fleet-enrollment-api-keys-keyid
      parameters:
        - name: keyId
          in: path
          description: The ID of the enrollment API key
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key_response'
              examples:
                getEnrollmentApiKeyExample:
                  description: An enrollment API key
                  value:
                    item:
                      active: true
                      api_key: api-key-value-1
                      api_key_id: api-key-id-1
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: key-id-1
                      name: Default policy enrollment key
                      policy_id: policy-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No enrollment API key was found with the given ID
                  value:
                    error: Not Found
                    message: EnrollmentAPIKey key-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/bulk_assets:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Bulk get assets
      description: 'Retrieve multiple Kibana saved object assets by their IDs and types.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: post-fleet-epm-bulk-assets
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_get_bulk_assets_request'
            examples:
              postBulkGetAssetsRequestExample:
                description: Retrieve multiple assets by their IDs and types
                value:
                  assetIds:
                    - id: dashboard-id-1
                      type: dashboard
                    - id: index-pattern-id-1
                      type: index_pattern
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_bulk_assets_response'
              examples:
                postBulkGetAssetsExample:
                  description: Requested assets
                  value:
                    items:
                      - appLink: /app/dashboards#/view/dashboard-id-1
                        attributes:
                          title: My Dashboard
                        id: dashboard-id-1
                        type: dashboard
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/categories:
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get package categories
      description: 'Get a list of integration categories.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-categories
      parameters:
        - name: prerelease
          in: query
          description: 'When true, include prerelease packages in the results'
          schema:
            type: boolean
        - name: include_policy_templates
          in: query
          description: 'When true, include categories that only contain policy templates'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_categories_response'
              examples:
                getCategoriesExample:
                  description: List of integration categories
                  value:
                    items:
                      - count: 42
                        id: security
                        title: Security
                      - count: 38
                        id: observability
                        title: Observability
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/custom_integrations:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Create a custom integration
      description: 'Create a new custom integration package with user-defined data streams.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-custom-integrations
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_custom_integration_request'
            examples:
              postCreateCustomIntegrationRequestExample:
                description: Create a new custom integration
                value:
                  datasets:
                    - name: my_custom_logs.access
                      type: logs
                  integrationName: my_custom_logs
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
              examples:
                postCreateCustomIntegrationExample:
                  description: Custom integration successfully created
                  value:
                    _meta:
                      install_source: custom
                    items:
                      - id: my_custom_logs-logs-my_custom_logs.access
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/custom_integrations/{pkgName}':
    put:
      tags:
        - Elastic Package Manager (EPM)
      summary: Update a custom integration
      description: 'Update the datasets of an existing custom integration package.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all AND integrations-all.'
      operationId: put-fleet-epm-custom-integrations-pkgname
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - readMeData
              type: object
              properties:
                categories:
                  maxItems: 10
                  type: array
                  items:
                    type: string
                readMeData:
                  type: string
              additionalProperties: false
            examples:
              putUpdateCustomIntegrationRequestExample:
                description: Update a custom integration
                value:
                  datasets:
                    - name: my_custom_logs.access
                      type: logs
                  integrationName: my_custom_logs
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              examples:
                putUpdateCustomIntegrationExample:
                  description: Custom integration successfully updated
                  value: { }
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/data_streams:
    get:
      tags:
        - Data streams
      summary: Get data streams
      description: 'Get a list of data streams created by installed integration packages.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-data-streams
      parameters:
        - name: type
          in: query
          description: Filter by data stream type
          schema:
            enum:
              - logs
              - metrics
              - traces
              - synthetics
              - profiles
            type: string
        - name: datasetQuery
          in: query
          description: Filter data streams by dataset name
          schema:
            type: string
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending'
          schema:
            enum:
              - asc
              - desc
            type: string
            default: asc
        - name: uncategorisedOnly
          in: query
          description: 'When true, only return data streams that are not associated with a package'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_data_streams_response'
              examples:
                getDataStreamsExample:
                  description: List of data streams from installed packages
                  value:
                    data_streams:
                      - ilm_policy: logs-default
                        index_template: logs-system.syslog
                        name: logs-system.syslog-default
                        package: system
                        package_version: 1.55.0
                        title: System syslog logs
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages:
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get packages
      description: 'Get a list of integration packages available in the registry.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-packages
      parameters:
        - name: category
          in: query
          description: Filter packages by category
          schema:
            type: string
        - name: prerelease
          in: query
          description: 'When true, include prerelease packages in the results'
          schema:
            type: boolean
        - name: excludeInstallStatus
          in: query
          description: 'When true, exclude the install status from the response'
          schema:
            type: boolean
        - name: withPackagePoliciesCount
          in: query
          description: 'When true, include the number of package policies per package'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_packages_response'
              examples:
                getPackagesExample:
                  description: List of available integration packages
                  value:
                    items:
                      - categories:
                          - cloud
                        description: Collect logs and metrics from Amazon Web Services
                        id: aws
                        name: aws
                        status: not_installed
                        title: AWS
                        version: '2.10.0'
                    searchExcluded: 0
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Install a package by upload
      description: "Install a package by uploading a .zip or .tar.gz archive (max 100MB).\n\nArchives that contain Kibana assets requiring additional privileges are subject to a preflight authorization check before the package is installed. Privileges are checked in every space the package will be installed into.\n\nThe following asset types require the corresponding Kibana API privilege:\n\n- `security_rule`: `rules-all`\n- `security_rule` with type `machine_learning`: `rules-all` and `ml:canCreateJob`\n- `security_ai_prompt`: `elasticAssistant`\n\nIf any required privilege is missing, the request returns 403 and no assets are written. To learn more, refer to [Upload an integration to Kibana](https://www.elastic.co/docs/extend/integrations/upload-new-integration).<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all."
      operationId: post-fleet-epm-packages
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: ignoreMappingUpdateErrors
          in: query
          description: 'When true, ignore mapping update errors during installation'
          schema:
            type: boolean
            default: false
        - name: skipDataStreamRollover
          in: query
          description: 'When true, skip data stream rollover after installation'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/gzip:
            examples:
              postInstallByUploadRequestExample:
                description: Upload a .zip or .tar.gz package archive (max 100MB)
                value: <binary package archive>
          application/gzip; application/zip:
            schema:
              type: string
              format: binary
            examples:
              postInstallByUploadRequestExample:
                description: Upload a .zip or .tar.gz package archive (max 100MB)
                value: <binary package archive>
      responses:
        '200':
          description: Successful response
          content:
            application/gzip; application/zip:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
              examples:
                postInstallByUploadExample:
                  description: Package successfully installed from upload
                  value:
                    _meta:
                      install_source: upload
                    items:
                      - id: my-custom-package-logs-default
                        type: index_template
            application/json:
              examples:
                postInstallByUploadExample:
                  description: Package successfully installed from upload
                  value:
                    _meta:
                      install_source: upload
                    items:
                      - id: my-custom-package-logs-default
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/gzip; application/zip:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
            application/json:
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '403':
          description: Forbidden. The caller lacks a Kibana API privilege required by an asset in the archive. No assets are written.
          content:
            application/gzip; application/zip:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                insufficientPrivilegesExample:
                  summary: Missing rules-all privilege
                  description: Caller lacks a privilege required by a gated asset type in the archive
                  value:
                    error: Forbidden
                    message: Insufficient privileges to upload this package
                    statusCode: 403
            application/json:
              examples:
                insufficientPrivilegesExample:
                  summary: Missing rules-all privilege
                  description: Caller lacks a privilege required by a gated asset type in the archive
                  value:
                    error: Forbidden
                    message: Insufficient privileges to upload this package
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Bulk install packages
      description: 'Install multiple packages from the Elastic Package Registry in a single request.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-bulk
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: prerelease
          in: query
          description: 'When true, allow installing prerelease versions'
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_from_registry_request'
            examples:
              postBulkInstallPackagesRequestExample:
                description: Install multiple packages from the registry
                value:
                  packages:
                    - system
                    - aws
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_from_registry_response'
              examples:
                postBulkInstallPackagesExample:
                  description: Bulk install results
                  value:
                    items:
                      - name: system
                        result:
                          assets: [ ]
                          status: installed
                      - name: aws
                        result:
                          assets: [ ]
                          status: installed
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_namespace_customization:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Bulk enable/disable namespace-level customization for packages
      description: 'Enable or disable namespace-level index template customization for a list of packages in one call. Use this for IaC-style declarative flows.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-bulk-namespace-customization
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_namespace_customization_request'
            examples:
              bulkNamespaceCustomizationRequest:
                value:
                  disable:
                    - dev
                  enable:
                    - production
                    - staging
                  packages:
                    - system
                    - nginx
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_namespace_customization_response'
              examples:
                successResponse:
                  value:
                    items:
                      - name: system
                        namespace_customization_enabled_for:
                          - production
                          - staging
                        success: true
                      - error: Package nginx is not installed
                        name: nginx
                        success: false
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    error: Bad Request
                    message: 'Namespaces must not appear in both enable and disable: production'
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_rollback:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Bulk rollback packages
      description: 'Rollback multiple packages to their previous versions.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-bulk-rollback
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_rollback_packages_request'
            examples:
              bulkRollbackRequest:
                value:
                  packages:
                    - name: system
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_rollback_packages_response'
              examples:
                successResponse:
                  value:
                    taskId: taskId
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/_bulk_rollback/{taskId}':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get Bulk rollback packages details
      description: 'Get the status and results of a bulk package rollback operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: get-fleet-epm-packages-bulk-rollback-taskid
      parameters:
        - name: taskId
          in: path
          description: Task ID of the bulk operation
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
              examples:
                successResponse:
                  value:
                    status: success
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_uninstall:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Bulk uninstall packages
      description: 'Uninstall multiple packages in a single operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-bulk-uninstall
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_uninstall_packages_request'
            examples:
              postBulkUninstallPackagesRequestExample:
                description: Uninstall multiple packages
                value:
                  packages:
                    - name: aws
                    - name: gcp
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_packages_response'
              examples:
                postBulkUninstallPackagesExample:
                  description: Bulk uninstall task initiated
                  value:
                    taskId: task-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/_bulk_uninstall/{taskId}':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get Bulk uninstall packages details
      description: 'Get the status and results of a bulk package uninstall operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: get-fleet-epm-packages-bulk-uninstall-taskid
      parameters:
        - name: taskId
          in: path
          description: Task ID of the bulk operation
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
              examples:
                getBulkOperationDetailsExample:
                  description: Details of the bulk operation task
                  value:
                    packages:
                      - name: system
                        result: installed
                      - name: elastic_agent
                        result: installed
                    status: success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/_bulk_upgrade:
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Bulk upgrade packages
      description: 'Upgrade multiple packages to their latest versions.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-bulk-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_packages_request'
            examples:
              postBulkUpgradePackagesRequestExample:
                description: Upgrade multiple packages to their latest versions
                value:
                  packages:
                    - name: system
                    - name: elastic_agent
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_packages_response'
              examples:
                postBulkUpgradePackagesExample:
                  description: Bulk upgrade task initiated
                  value:
                    taskId: task-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/_bulk_upgrade/{taskId}':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get Bulk upgrade packages details
      description: 'Get the status and results of a bulk package upgrade operation.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: get-fleet-epm-packages-bulk-upgrade-taskid
      parameters:
        - name: taskId
          in: path
          description: Task ID of the bulk operation
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_one_bulk_operation_packages_response'
              examples:
                getBulkOperationDetailsExample:
                  description: Details of the bulk operation task
                  value:
                    packages:
                      - name: system
                        result: installed
                      - name: elastic_agent
                        result: installed
                    status: success
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}':
    delete:
      tags:
        - Elastic Package Manager (EPM)
      summary: Delete a package
      description: 'Uninstall a package and remove all its assets.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: delete-fleet-epm-packages-pkgname
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            maxLength: 255
            type: string
        - name: force
          in: query
          description: 'When true, delete the package even if it has active package policies'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_response'
              examples:
                deletePackageExample:
                  description: Package successfully deleted
                  value:
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get a package
      description: 'Get information about a package by name, returning the latest installed or available version.'
      operationId: get-fleet-epm-packages-pkgname
      parameters:
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            maxLength: 255
            type: string
        - name: ignoreUnverified
          in: query
          description: 'When true, returns the package even if the signature cannot be verified'
          schema:
            type: boolean
        - name: prerelease
          in: query
          description: 'When true, include prerelease versions'
          schema:
            type: boolean
        - name: full
          in: query
          description: 'When true, return the full package info including assets'
          schema:
            type: boolean
        - name: withMetadata
          in: query
          description: 'When true, include package metadata such as whether it has package policies'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_info_response'
              examples:
                getPackageInfoExample:
                  description: Package details and installation status
                  value:
                    item:
                      assets:
                        kibana:
                          dashboard: [ ]
                          index_pattern: [ ]
                      categories:
                        - cloud
                      description: Collect logs and metrics from Amazon Web Services
                      name: aws
                      status: installed
                      title: AWS
                      version: '2.10.0'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Install a package from the registry
      description: 'Install the latest version of a package from the Elastic Package Registry.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-pkgname
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            maxLength: 255
            type: string
        - name: prerelease
          in: query
          description: 'When true, allow installing prerelease versions'
          schema:
            type: boolean
        - name: ignoreMappingUpdateErrors
          in: query
          description: 'When true, ignore mapping update errors during installation'
          schema:
            type: boolean
            default: false
        - name: skipDataStreamRollover
          in: query
          description: 'When true, skip data stream rollover after installation'
          schema:
            type: boolean
            default: false
        - name: skipDependencyCheck
          in: query
          description: Skip dependency validation when installing a package with dependencies
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_from_registry_request'
              default: 'null'
            examples:
              postInstallPackageRequestExample:
                description: 'Install a package, optionally ignoring constraints'
                value:
                  ignore_constraints: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
              examples:
                postInstallPackageExample:
                  description: Package successfully installed
                  value:
                    _meta:
                      install_source: registry
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Elastic Package Manager (EPM)
      summary: Update package settings
      description: 'Update settings for a package, such as whether policies are kept up to date automatically.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: put-fleet-epm-packages-pkgname
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_request'
            examples:
              putUpdatePackageNamespaceCustomizationExample:
                description: Enable namespace-level customization for the `production` and `staging` namespaces
                value:
                  namespace_customization_enabled_for:
                    - production
                    - staging
              putUpdatePackageRequestExample:
                description: Update keep_policies_up_to_date setting for a package
                value:
                  keepPoliciesUpToDate: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_response'
              examples:
                putUpdatePackageExample:
                  description: Updated package settings
                  value:
                    item:
                      keepPoliciesUpToDate: true
                      name: aws
                      version: '2.10.0'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}':
    delete:
      tags:
        - Elastic Package Manager (EPM)
      summary: Delete a package
      description: 'Uninstall a specific version of a package and remove all its assets.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: delete-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: force
          in: query
          description: 'When true, delete the package even if it has active package policies'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_response'
              examples:
                deletePackageExample:
                  description: Package successfully deleted
                  value:
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get a package
      description: Get information about a specific version of a package.
      operationId: get-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: ignoreUnverified
          in: query
          description: 'When true, returns the package even if the signature cannot be verified'
          schema:
            type: boolean
        - name: prerelease
          in: query
          description: 'When true, include prerelease versions'
          schema:
            type: boolean
        - name: full
          in: query
          description: 'When true, return the full package info including assets'
          schema:
            type: boolean
        - name: withMetadata
          in: query
          description: 'When true, include package metadata such as whether it has package policies'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_info_response'
              examples:
                getPackageInfoExample:
                  description: Package details and installation status
                  value:
                    item:
                      assets:
                        kibana:
                          dashboard: [ ]
                          index_pattern: [ ]
                      categories:
                        - cloud
                      description: Collect logs and metrics from Amazon Web Services
                      name: aws
                      status: installed
                      title: AWS
                      version: '2.10.0'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Install a package from the registry
      description: 'Install a specific version of a package from the Elastic Package Registry.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: prerelease
          in: query
          description: 'When true, allow installing prerelease versions'
          schema:
            type: boolean
        - name: ignoreMappingUpdateErrors
          in: query
          description: 'When true, ignore mapping update errors during installation'
          schema:
            type: boolean
            default: false
        - name: skipDataStreamRollover
          in: query
          description: 'When true, skip data stream rollover after installation'
          schema:
            type: boolean
            default: false
        - name: skipDependencyCheck
          in: query
          description: Skip dependency validation when installing a package with dependencies
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_from_registry_request'
              default: 'null'
            examples:
              postInstallPackageRequestExample:
                description: 'Install a package, optionally ignoring constraints'
                value:
                  ignore_constraints: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_package_response'
              examples:
                postInstallPackageExample:
                  description: Package successfully installed
                  value:
                    _meta:
                      install_source: registry
                    items:
                      - id: aws-logs-aws.cloudwatch_logs-default
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Elastic Package Manager (EPM)
      summary: Update package settings
      description: 'Update settings for a specific version of a package.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: put-fleet-epm-packages-pkgname-pkgversion
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_request'
            examples:
              putUpdatePackageNamespaceCustomizationExample:
                description: Enable namespace-level customization for the `production` and `staging` namespaces
                value:
                  namespace_customization_enabled_for:
                    - production
                    - staging
              putUpdatePackageRequestExample:
                description: Update keep_policies_up_to_date setting for a package
                value:
                  keepPoliciesUpToDate: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_response'
              examples:
                putUpdatePackageExample:
                  description: Updated package settings
                  value:
                    item:
                      keepPoliciesUpToDate: true
                      name: aws
                      version: '2.10.0'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}/{filePath}':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get a package file
      description: 'Get the contents of a specific file from a package.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-packages-pkgname-pkgversion-filepath
      parameters:
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: filePath
          in: path
          description: File path within the package
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response — returns the file content
          content:
            application/json:
              schema: { }
              examples:
                getPackageFileExample:
                  description: The content of the requested package file
                  value: <file content>
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}/datastream_assets':
    delete:
      tags:
        - Elastic Package Manager (EPM)
      summary: Delete assets for a package
      description: 'Delete datastream assets for a specific package, by data stream name.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: delete-fleet-epm-packages-pkgname-pkgversion-datastream-assets
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: packagePolicyId
          in: query
          description: The ID of the package policy
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_datastream_assets_response'
              examples:
                deletePackageDatastreamAssetsExample:
                  description: Package datastream assets successfully deleted
                  value:
                    items:
                      - id: logs-my_package.access-default
                        type: index_template
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}/dependencies':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get package dependencies
      description: 'Get the list of packages that a specific package depends on.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-packages-pkgname-pkgversion-dependencies
      parameters:
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_dependencies_response'
              examples:
                dependenciesResponse:
                  value:
                    items:
                      - name: aws
                        title: AWS
                        version: ^2.0.0
                      - name: system
                        title: System
                        version: ^1.0.0
                noDependenciesResponse:
                  value:
                    items: [ ]
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                packageNotFoundResponse:
                  value:
                    message: '[my-package-1.0.0] package not found in registry'
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}/kibana_assets':
    delete:
      tags:
        - Elastic Package Manager (EPM)
      summary: Delete Kibana assets for a package
      description: 'Delete Kibana assets (dashboards, visualizations, etc.) for a specific package version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: delete-fleet-epm-packages-pkgname-pkgversion-kibana-assets
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_response'
              examples:
                deleteKibanaAssetsExample:
                  description: Kibana assets successfully deleted
                  value:
                    items:
                      - id: dashboard-id-1
                        type: dashboard
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Install Kibana assets for a package
      description: 'Install Kibana assets (dashboards, visualizations, etc.) for a specific package version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-pkgname-pkgversion-kibana-assets
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_request'
              default: 'null'
            examples:
              postInstallKibanaAssetsRequestExample:
                description: Install Kibana assets for a specific package version
                value: { }
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_response'
              examples:
                postInstallKibanaAssetsExample:
                  description: Kibana assets successfully installed
                  value:
                    items:
                      - id: dashboard-id-1
                        type: dashboard
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}/rule_assets':
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Install Kibana alert rule for a package
      description: 'Install Kibana alert rule assets for a specific package version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-pkgname-pkgversion-rule-assets
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_install_rule_assets_request'
              default: 'null'
            examples:
              postInstallRuleAssetsRequestExample:
                description: Install alert rule assets for a specific package version
                value: { }
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_install_kibana_assets_response'
              examples:
                postInstallRuleAssetsExample:
                  description: Rule assets successfully installed
                  value:
                    items:
                      - id: rule-asset-id-1
                        type: security_rule
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/{pkgVersion}/transforms/authorize':
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Authorize transforms
      description: Reauthorize Elasticsearch transforms installed by a package with secondary authorization headers.
      operationId: post-fleet-epm-packages-pkgname-pkgversion-transforms-authorize
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: prerelease
          in: query
          description: 'When true, allow prerelease versions'
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_reauthorize_transform_request'
            examples:
              postReauthorizeTransformsRequestExample:
                description: Reauthorize transforms for a package
                value:
                  transforms:
                    - destinations:
                        - index: logs-transform-dest
                      transformId: logs-transform-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  required:
                    - transformId
                    - success
                    - error
                  type: object
                  properties:
                    error: { }
                    success:
                      type: boolean
                    transformId:
                      type: string
                  additionalProperties: false
              examples:
                postReauthorizeTransformsExample:
                  description: Transforms successfully reauthorized
                  value:
                    - success: true
                      transformId: logs-transform-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/review_upgrade':
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Review a pending policy upgrade for a package with deprecations
      description: 'Review and accept or reject a pending policy upgrade for a package that contains deprecations.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-pkgname-review-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name to review upgrade for
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_review_upgrade_request'
            examples:
              acceptUpgrade:
                value:
                  action: accept
                  target_version: 2.0.0
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_review_upgrade_response'
              examples:
                successResponse:
                  value:
                    success: true
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/rollback':
    post:
      tags:
        - Elastic Package Manager (EPM)
      summary: Rollback a package to previous version
      description: 'Rollback a package to its previously installed version.<br/><br/>[Required authorization] Route required privileges: integrations-all AND fleet-agent-policies-all.'
      operationId: post-fleet-epm-packages-pkgname-rollback
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: pkgName
          in: path
          description: Package name to roll back
          required: true
          schema:
            type: string
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_rollback_package_response'
              examples:
                successResponse:
                  value:
                    success: true
                    version: 1.0.0
        '400':
          description: A bad request.
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestResponse:
                  value:
                    message: Bad Request
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/packages/{pkgName}/stats':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get package stats
      description: 'Get usage statistics for a specific package, such as the number of agent policies using it.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-packages-pkgname-stats
      parameters:
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_stats_response'
              examples:
                getPackageStatsExample:
                  description: Usage stats for a specific package
                  value:
                    response:
                      agent_policy_count: 3
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/installed:
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get installed packages
      description: 'Get a list of all currently installed integration packages.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-packages-installed
      parameters:
        - name: dataStreamType
          in: query
          description: Filter by data stream type
          schema:
            enum:
              - logs
              - metrics
              - traces
              - synthetics
              - profiles
            type: string
        - name: showOnlyActiveDataStreams
          in: query
          description: 'When true, only return packages with active data streams'
          schema:
            type: boolean
        - name: nameQuery
          in: query
          description: Filter packages by name
          schema:
            type: string
        - name: searchAfter
          in: query
          description: Sort values from the previous page for `search_after` pagination
          schema:
            maxItems: 10
            type: array
            items:
              type:
                - number
                - string
        - name: perPage
          in: query
          description: Number of results per page
          schema:
            type: number
            default: 15
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending'
          schema:
            enum:
              - asc
              - desc
            type: string
            default: asc
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_installed_packages_response'
              examples:
                getInstalledPackagesExample:
                  description: List of installed integration packages
                  value:
                    items:
                      - name: system
                        status: installed
                        title: System
                        version: 1.55.0
                      - name: elastic_agent
                        status: installed
                        title: Elastic Agent
                        version: '1.15.0'
                    searchExcluded: 0
                    total: 2
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/packages/limited:
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get a limited package list
      description: 'Get the list of packages that cannot be uninstalled (e.g. elastic_agent, fleet_server).<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-packages-limited
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_limited_packages_response'
              examples:
                getLimitedPackagesExample:
                  description: List of packages that cannot be uninstalled
                  value:
                    items:
                      - elastic_agent
                      - fleet_server
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/epm/templates/{pkgName}/{pkgVersion}/inputs':
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get an inputs template
      description: 'Get an inputs template for a package, used to pre-populate package policy forms.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-templates-pkgname-pkgversion-inputs
      parameters:
        - name: pkgName
          in: path
          description: Package name
          required: true
          schema:
            type: string
        - name: pkgVersion
          in: path
          description: Package version
          required: true
          schema:
            type: string
        - name: format
          in: query
          description: 'Output format for the inputs template: json, yml, or yaml'
          schema:
            enum:
              - json
              - yml
              - yaml
            type: string
            default: json
        - name: prerelease
          in: query
          description: 'When true, allow prerelease versions'
          schema:
            type: boolean
        - name: ignoreUnverified
          in: query
          description: 'When true, return inputs even if the package signature cannot be verified'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                anyOf:
                  - type: string
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_get_inputs_response'
              examples:
                getInputsTemplateExample:
                  description: Inputs template for a package
                  value:
                    inputs:
                      - description: Collect logs from log files
                        title: Collect logs from files
                        type: logfile
                        vars:
                          - name: paths
                            required: true
                            title: Paths
                            type: text
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/epm/verification_key_id:
    get:
      tags:
        - Elastic Package Manager (EPM)
      summary: Get a package signature verification key ID
      description: 'Get the GPG key ID used to verify the signatures of packages from the Elastic Package Registry.<br/><br/>[Required authorization] Route required privileges: integrations-read OR fleet-setup OR fleet-all.'
      operationId: get-fleet-epm-verification-key-id
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_verification_key_id_response'
              examples:
                getVerificationKeyIdExample:
                  description: The GPG key ID used to verify package signatures
                  value:
                    id: D27D666CD88E42B4
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/fleet_server_hosts:
    get:
      tags:
        - Fleet Server hosts
      summary: Get Fleet Server hosts
      description: 'List all Fleet Server hosts.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all OR fleet-settings-read.'
      operationId: get-fleet-fleet-server-hosts
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - name
                        - host_urls
                        - id
                      type: object
                      properties:
                        allow_edit:
                          maxItems: 100
                          type: array
                          items:
                            maxLength: 100
                            type: string
                        host_urls:
                          maxItems: 10
                          minItems: 1
                          type: array
                          items:
                            type: string
                        id:
                          type: string
                        is_default:
                          type: boolean
                          default: false
                        is_internal:
                          type: boolean
                        is_preconfigured:
                          type: boolean
                          default: false
                        name:
                          type: string
                        proxy_id:
                          type:
                            - 'null'
                            - string
                        secrets:
                          type: object
                          properties:
                            ssl:
                              type: object
                              properties:
                                agent_key:
                                  anyOf:
                                    - required:
                                        - id
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      additionalProperties: false
                                    - type: string
                                es_key:
                                  anyOf:
                                    - required:
                                        - id
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      additionalProperties: false
                                    - type: string
                                key:
                                  anyOf:
                                    - required:
                                        - id
                                      type: object
                                      properties:
                                        id:
                                          type: string
                                      additionalProperties: false
                                    - type: string
                              additionalProperties: false
                          additionalProperties: false
                        ssl:
                          type:
                            - 'null'
                            - object
                          properties:
                            agent_certificate:
                              type: string
                            agent_certificate_authorities:
                              maxItems: 10
                              type: array
                              items:
                                type: string
                            agent_key:
                              type: string
                            certificate:
                              type: string
                            certificate_authorities:
                              maxItems: 10
                              type: array
                              items:
                                type: string
                            client_auth:
                              enum:
                                - optional
                                - required
                                - none
                              type: string
                            es_certificate:
                              type: string
                            es_certificate_authorities:
                              maxItems: 10
                              type: array
                              items:
                                type: string
                            es_key:
                              type: string
                            key:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getFleetServerHostsExample:
                  description: List of Fleet Server hosts
                  value:
                    items:
                      - host_urls:
                          - https://fleet-server.example.com:8220
                        id: fleet-server-host-id-1
                        is_default: true
                        is_preconfigured: false
                        name: Default Fleet Server
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet Server hosts
      summary: Create a Fleet Server host
      description: 'Create a new Fleet Server host.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: post-fleet-fleet-server-hosts
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - host_urls
              type: object
              properties:
                allow_edit:
                  maxItems: 100
                  type: array
                  items:
                    maxLength: 100
                    type: string
                host_urls:
                  maxItems: 10
                  minItems: 1
                  type: array
                  items:
                    type: string
                id:
                  type: string
                is_default:
                  type: boolean
                  default: false
                is_internal:
                  type: boolean
                is_preconfigured:
                  type: boolean
                  default: false
                name:
                  type: string
                proxy_id:
                  type:
                    - 'null'
                    - string
                secrets:
                  type: object
                  properties:
                    ssl:
                      type: object
                      properties:
                        agent_key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        es_key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                  additionalProperties: false
                ssl:
                  type:
                    - 'null'
                    - object
                  properties:
                    agent_certificate:
                      type: string
                    agent_certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    agent_key:
                      type: string
                    certificate:
                      type: string
                    certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    client_auth:
                      enum:
                        - optional
                        - required
                        - none
                      type: string
                    es_certificate:
                      type: string
                    es_certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    es_key:
                      type: string
                    key:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            examples:
              postFleetServerHostRequestExample:
                description: Create a new Fleet Server host
                value:
                  host_urls:
                    - https://fleet-server.example.com:8220
                  is_default: false
                  name: My Fleet Server
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - name
                      - host_urls
                      - id
                    type: object
                    properties:
                      allow_edit:
                        maxItems: 100
                        type: array
                        items:
                          maxLength: 100
                          type: string
                      host_urls:
                        maxItems: 10
                        minItems: 1
                        type: array
                        items:
                          type: string
                      id:
                        type: string
                      is_default:
                        type: boolean
                        default: false
                      is_internal:
                        type: boolean
                      is_preconfigured:
                        type: boolean
                        default: false
                      name:
                        type: string
                      proxy_id:
                        type:
                          - 'null'
                          - string
                      secrets:
                        type: object
                        properties:
                          ssl:
                            type: object
                            properties:
                              agent_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              es_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                        additionalProperties: false
                      ssl:
                        type:
                          - 'null'
                          - object
                        properties:
                          agent_certificate:
                            type: string
                          agent_certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          agent_key:
                            type: string
                          certificate:
                            type: string
                          certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          client_auth:
                            enum:
                              - optional
                              - required
                              - none
                            type: string
                          es_certificate:
                            type: string
                          es_certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          es_key:
                            type: string
                          key:
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                postFleetServerHostExample:
                  description: The created Fleet Server host
                  value:
                    item:
                      host_urls:
                        - https://fleet-server.example.com:8220
                      id: fleet-server-host-id-2
                      is_default: false
                      is_preconfigured: false
                      name: My Fleet Server
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/fleet_server_hosts/{itemId}':
    delete:
      tags:
        - Fleet Server hosts
      summary: Delete a Fleet Server host
      description: 'Delete a Fleet Server host by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: delete-fleet-fleet-server-hosts-itemid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: itemId
          in: path
          description: The ID of the Fleet Server host
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteFleetServerHostExample:
                  description: The Fleet Server host was successfully deleted
                  value:
                    id: fleet-server-host-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet server fleet-server-host-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet Server hosts
      summary: Get a Fleet Server host
      description: 'Get a Fleet Server host by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.'
      operationId: get-fleet-fleet-server-hosts-itemid
      parameters:
        - name: itemId
          in: path
          description: The ID of the Fleet Server host
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - name
                      - host_urls
                      - id
                    type: object
                    properties:
                      allow_edit:
                        maxItems: 100
                        type: array
                        items:
                          maxLength: 100
                          type: string
                      host_urls:
                        maxItems: 10
                        minItems: 1
                        type: array
                        items:
                          type: string
                      id:
                        type: string
                      is_default:
                        type: boolean
                        default: false
                      is_internal:
                        type: boolean
                      is_preconfigured:
                        type: boolean
                        default: false
                      name:
                        type: string
                      proxy_id:
                        type:
                          - 'null'
                          - string
                      secrets:
                        type: object
                        properties:
                          ssl:
                            type: object
                            properties:
                              agent_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              es_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                        additionalProperties: false
                      ssl:
                        type:
                          - 'null'
                          - object
                        properties:
                          agent_certificate:
                            type: string
                          agent_certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          agent_key:
                            type: string
                          certificate:
                            type: string
                          certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          client_auth:
                            enum:
                              - optional
                              - required
                              - none
                            type: string
                          es_certificate:
                            type: string
                          es_certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          es_key:
                            type: string
                          key:
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                getFleetServerHostExample:
                  description: A Fleet Server host
                  value:
                    item:
                      host_urls:
                        - https://fleet-server.example.com:8220
                      id: fleet-server-host-id-1
                      is_default: true
                      is_preconfigured: false
                      name: Default Fleet Server
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet server fleet-server-host-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet Server hosts
      summary: Update a Fleet Server host
      description: 'Update a Fleet Server host by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: put-fleet-fleet-server-hosts-itemid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: itemId
          in: path
          description: The ID of the Fleet Server host
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                allow_edit:
                  maxItems: 100
                  type: array
                  items:
                    maxLength: 100
                    type: string
                host_urls:
                  maxItems: 10
                  minItems: 1
                  type: array
                  items:
                    type: string
                is_default:
                  type: boolean
                is_internal:
                  type: boolean
                name:
                  type: string
                proxy_id:
                  type:
                    - 'null'
                    - string
                  default: 'null'
                secrets:
                  type: object
                  properties:
                    ssl:
                      type: object
                      properties:
                        agent_key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        es_key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        key:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                  additionalProperties: false
                ssl:
                  type:
                    - 'null'
                    - object
                  properties:
                    agent_certificate:
                      type: string
                    agent_certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    agent_key:
                      type: string
                    certificate:
                      type: string
                    certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    client_auth:
                      enum:
                        - optional
                        - required
                        - none
                      type: string
                    es_certificate:
                      type: string
                    es_certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    es_key:
                      type: string
                    key:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            examples:
              putFleetServerHostRequestExample:
                description: Update a Fleet Server host
                value:
                  host_urls:
                    - https://updated-fleet-server.example.com:8220
                  is_default: false
                  name: Updated Fleet Server
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - name
                      - host_urls
                      - id
                    type: object
                    properties:
                      allow_edit:
                        maxItems: 100
                        type: array
                        items:
                          maxLength: 100
                          type: string
                      host_urls:
                        maxItems: 10
                        minItems: 1
                        type: array
                        items:
                          type: string
                      id:
                        type: string
                      is_default:
                        type: boolean
                        default: false
                      is_internal:
                        type: boolean
                      is_preconfigured:
                        type: boolean
                        default: false
                      name:
                        type: string
                      proxy_id:
                        type:
                          - 'null'
                          - string
                      secrets:
                        type: object
                        properties:
                          ssl:
                            type: object
                            properties:
                              agent_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              es_key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                              key:
                                anyOf:
                                  - required:
                                      - id
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                    additionalProperties: false
                                  - type: string
                            additionalProperties: false
                        additionalProperties: false
                      ssl:
                        type:
                          - 'null'
                          - object
                        properties:
                          agent_certificate:
                            type: string
                          agent_certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          agent_key:
                            type: string
                          certificate:
                            type: string
                          certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          client_auth:
                            enum:
                              - optional
                              - required
                              - none
                            type: string
                          es_certificate:
                            type: string
                          es_certificate_authorities:
                            maxItems: 10
                            type: array
                            items:
                              type: string
                          es_key:
                            type: string
                          key:
                            type: string
                        additionalProperties: false
                    additionalProperties: false
                additionalProperties: false
              examples:
                putFleetServerHostExample:
                  description: The updated Fleet Server host
                  value:
                    item:
                      host_urls:
                        - https://updated-fleet-server.example.com:8220
                      id: fleet-server-host-id-1
                      is_default: false
                      is_preconfigured: false
                      name: Updated Fleet Server
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet server fleet-server-host-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/health_check:
    post:
      tags:
        - Fleet internals
      summary: Check Fleet Server health
      description: 'Check the health status of a Fleet Server instance by its host ID. Returns the server status and name if available.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: post-fleet-health-check
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - id
              type: object
              properties:
                id:
                  type: string
              additionalProperties: false
            examples:
              postHealthCheckRequestExample:
                description: Check the health of a Fleet Server instance by its host ID
                value:
                  id: fleet-server-host-id-1
      responses:
        '200':
          description: Successful health check response
          content:
            application/json:
              schema:
                required:
                  - status
                type: object
                properties:
                  host_id:
                    type: string
                  name:
                    type: string
                  status:
                    type: string
                additionalProperties: false
              examples:
                postHealthCheckHealthyExample:
                  description: Fleet Server is online and healthy
                  value:
                    name: fleet-server-1
                    status: ONLINE
                postHealthCheckUnreachableExample:
                  description: Fleet Server host is not reachable (request timed out or aborted)
                  value:
                    host_id: fleet-server-host-id-1
                    status: OFFLINE
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                badRequestExample:
                  description: The host ID exists but has no associated host URLs configured
                  value:
                    error: Bad Request
                    message: The requested host id fleet-server-host-id-1 does not have associated host urls.
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                notFoundExample:
                  description: No Fleet Server host was found with the given ID
                  value:
                    error: Not Found
                    message: The requested host id fleet-server-host-id-1 does not exist.
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/kubernetes:
    get:
      tags:
        - Elastic Agent policies
      summary: Get a full K8s agent manifest
      description: 'Get the Kubernetes manifest for deploying Elastic Agent.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.'
      operationId: get-fleet-kubernetes
      parameters:
        - name: download
          in: query
          description: 'If true, returns the manifest as a downloadable file'
          schema:
            type: boolean
        - name: fleetServer
          in: query
          description: Fleet Server host URL to include in the manifest
          schema:
            type: string
        - name: enrolToken
          in: query
          description: Enrollment token to include in the manifest
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_get_k8s_manifest_response'
              examples:
                getK8sManifestExample:
                  description: The Kubernetes manifest for deploying Elastic Agent
                  value:
                    item: 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: agent-node-datastreams\n  namespace: kube-system\n'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/kubernetes/download:
    get:
      tags:
        - Elastic Agent policies
      summary: Download an agent manifest
      description: 'Download the Kubernetes manifest for deploying Elastic Agent.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read OR fleet-setup.'
      operationId: get-fleet-kubernetes-download
      parameters:
        - name: download
          in: query
          description: 'If true, returns the manifest as a downloadable file'
          schema:
            type: boolean
        - name: fleetServer
          in: query
          description: Fleet Server host URL to include in the manifest
          schema:
            type: string
        - name: enrolToken
          in: query
          description: Enrollment token to include in the manifest
          schema:
            type: string
      responses:
        '200':
          description: Successful response — returns the Kubernetes manifest as a YAML file download
          content:
            application/json:
              schema:
                type: string
              examples:
                getDownloadK8sManifestExample:
                  description: The Kubernetes manifest download
                  value: 'apiVersion: v1\nkind: ConfigMap\nmetadata:\n  name: agent-node-datastreams\n  namespace: kube-system\n'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                notFoundExample:
                  description: No manifest was found
                  value:
                    error: Not Found
                    message: Agent manifest not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/logstash_api_keys:
    post:
      tags:
        - Fleet outputs
      summary: Generate a Logstash API key
      description: 'Generate an API key for Logstash to use with a Fleet output.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: post-fleet-logstash-api-keys
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - api_key
                type: object
                properties:
                  api_key:
                    type: string
                additionalProperties: false
              examples:
                postLogstashApiKeyExample:
                  description: The generated Logstash API key
                  value:
                    api_key: TiNAGG4BaaMdaH1tRfuU:KnR6yE41RrSowb0kQ0HWoA
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations:
    get:
      tags:
        - Fleet managed integrations
      summary: Get managed integrations
      description: List managed integrations
      operationId: get-fleet-managed-integrations
      parameters:
        - name: page
          in: query
          description: Page number. Defaults to `1`.
          schema:
            type: number
        - name: perPage
          in: query
          description: Number of results per page. Defaults to `20`.
          schema:
            type: number
        - name: sortField
          in: query
          description: Field to sort results by. Defaults to `updated_at`.
          schema:
            maxLength: 256
            type: string
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending. Defaults to `desc`.'
          schema:
            enum:
              - desc
              - asc
            type: string
        - name: kuery
          in: query
          description: 'A KQL query string to filter results. Filtering is restricted to the following fields: `name`, `namespace`, `package.name`.'
          schema:
            maxLength: 4096
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                listManagedIntegrationsResponseExample:
                  description: Example response for listing managed integrations
                  value:
                    items:
                      - created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            streams:
                              ess_billing.billing:
                                enabled: true
                              ess_billing.credits:
                                enabled: false
                            vars:
                              api_key:
                                id: QY1sWpoBbWcMW-edr0Ee
                                isSecretRef: true
                              organization_id: '1234'
                              url: https://billing.elastic-cloud.com
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: '1.6.0'
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      - cloud_connector:
                          cloud_connector_id: aws-connector-67890
                          enabled: true
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: CSPM integration for AWS with cloud connector
                        id: aws-policy-12345
                        inputs:
                          cspm-cloudbeat/cis_aws:
                            enabled: true
                        name: cspm-aws-policy
                        namespace: default
                        package:
                          name: cloud_security_posture
                          title: Cloud Security Posture Management
                          version: '3.1.1'
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                        vars:
                          deployment: aws
                          posture: cspm
                    page: 1
                    perPage: 20
                    total: 2
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet managed integrations
      summary: Create a managed integration
      description: Create a managed integration
      operationId: post-fleet-managed-integrations
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
            examples:
              createManagedIntegrationsRequestExample:
                description: Example request to create a managed integration
                value:
                  description: test
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 365
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.6.0'
              createManagedIntegrationsReuseAWSCloudConnectorExample:
                description: Example request to create a managed integration reusing an existing AWS cloud connector
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-reuse-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAWSCloudConnectorExample:
                description: Example request to create a managed integration with AWS cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              createManagedIntegrationsWithAzureCloudConnectorExample:
                description: Example request to create a managed integration with Azure cloud connector
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: azure
                  description: CSPM integration for Azure with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: false
                    cspm-cloudbeat/cis_azure:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            azure_credentials_cloud_connector_id:
                              type: text
                              value: existing-azure-credentials-connector-id
                            azure.account_type: organization-account
                            client_id:
                              id: client-secret-id
                              isSecretRef: true
                            tenant_id:
                              id: tenant-secret-id
                              isSecretRef: true
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-azure-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: azure
                    posture: cspm
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
              examples:
                createManagedIntegrationsResponseExample:
                  description: Example response for creating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: '1.6.0'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                createManagedIntegrationsWithAWSCloudConnectorResponseExample:
                  description: Example response for AWS cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: '3.1.1'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
                createManagedIntegrationsWithAzureCloudConnectorResponseExample:
                  description: Example response for Azure cloud connector integration
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: azure-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for Azure with cloud connector
                      id: azure-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: false
                        cspm-cloudbeat/cis_azure:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                azure_credentials_cloud_connector_id:
                                  type: text
                                  value: existing-azure-credentials-connector-id
                                azure.account_type: organization-account
                                client_id:
                                  id: client-secret-id-456
                                  isSecretRef: true
                                tenant_id:
                                  id: tenant-secret-id-123
                                  isSecretRef: true
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-azure-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: '3.1.1'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
                      vars:
                        deployment: azure
                        posture: cspm
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations/_upgrade:
    post:
      tags:
        - Fleet managed integrations
      summary: Bulk upgrade managed integrations
      description: 'Upgrade multiple managed integrations to their installed package version, migrating each package policy''s config onto the new schema. Always returns 200 with a per-policy result array; a missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch, so valid ids are still upgraded. A successful result means the policy''s saved object was upgraded, while the agentless deployment is reconciled asynchronously in the background. Policies already at the installed version are a genuine no-op: they still report `success: true` (calls stay idempotent) but nothing is re-persisted or redeployed. Note: agent-policy-level agentless settings (resources, ownership tags) are not re-derived from the new package version — use the update (PUT) endpoint for those.'
      operationId: post-fleet-managed-integrations-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request'
            examples:
              upgradeManagedIntegrationsRequestExample:
                description: Bulk upgrade managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
                    - aws-policy-12345
      responses:
        '200':
          description: 'Indicates a successful response. Each item reports the per-policy upgrade outcome; inspect every item''s `success` flag. A missing id, or an id that is not a managed integration, is reported as a per-item failure (`success: false` + `statusCode`) without failing the batch.'
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result'
              examples:
                upgradeManagedIntegrationsPartialFailureResponseExample:
                  description: Example response where one managed integration upgraded and another id was missing or not a managed integration (the batch still returns 200)
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - body:
                        message: Agentless policy aws-policy-12345 not found
                      id: aws-policy-12345
                      statusCode: 404
                      success: false
                upgradeManagedIntegrationsResponseExample:
                  description: Example response where every policy was upgraded
                  value:
                    - id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      success: true
                    - id: aws-policy-12345
                      name: cspm-aws-policy
                      success: true
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/managed_integrations/_upgrade/dryrun:
    post:
      tags:
        - Fleet managed integrations
      summary: Preview a managed integrations upgrade
      description: 'Preview upgrading multiple managed integrations without applying any change. Targets the installed package version by default; pass `pkgVersion` to preview a specific (for example, not-yet-installed) version. Each result returns the current/proposed version and any migration errors, plus — only on a clean dry-run (`hasErrors: false`) — the migrated `proposedPolicy`. `proposedPolicy` is for the edit-and-upgrade flow (edit it, then save via the update (PUT) endpoint); to apply an upgrade as-is, use `_upgrade`.'
      operationId: post-fleet-managed-integrations-upgrade-dryrun
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request'
            examples:
              upgradeManagedIntegrationsDryRunRequestExample:
                description: Preview the upgrade of managed integrations to their installed package version
                value:
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
              upgradeManagedIntegrationsDryRunTargetVersionRequestExample:
                description: 'Preview the upgrade against an explicit target package version (for example, before installing the new version). Defaults to the installed package version when omitted.'
                value:
                  pkgVersion: '1.6.0'
                  policyIds:
                    - d52a7812-5736-4fdc-aed8-72152afa1ffa
      responses:
        '200':
          description: 'Indicates a successful response. Each clean item (`hasErrors: false`) previews the migrated policy as a consumable managed integration (`proposedPolicy`); a missing id, an id that is not a managed integration, or a migration error, is reported as a per-item failure (`hasErrors: true`, with `proposedPolicy` omitted) without failing the batch. Inspect every item.'
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_result'
              examples:
                upgradeManagedIntegrationsDryRunMigrationErrorsExample:
                  description: Example dry-run response where migrating the config to the new version produced errors. `hasErrors` is true and `errors` explains why; do not feed the (partial) proposed config into the update endpoint without resolving them.
                  value:
                    - currentVersion: '1.5.0'
                      errors:
                        - message: Variable "organization_id" is required
                      hasErrors: true
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedVersion: '1.6.0'
                upgradeManagedIntegrationsDryRunMixedResponseExample:
                  description: 'Example dry-run response for a mixed batch: one managed integration previews cleanly while two ids are missing or not managed integrations. Ids that are missing or not managed integrations are surfaced as per-item failures (`hasErrors: true` + `statusCode`) without failing the batch, and results stay in request order.'
                  value:
                    - currentVersion: 0.5.0
                      hasErrors: false
                      id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                      name: agentless_hello_world-16
                      proposedPolicy:
                        cloud_connector: 'null'
                        created_at: '2026-07-01T15:59:08.299Z'
                        created_by: admin
                        description: ''
                        id: 2e426392-f856-4ab2-bc31-92d4dbb8d134
                        inputs:
                          agentless_hello_world-cel:
                            enabled: true
                            streams:
                              agentless_hello_world.generic:
                                enabled: true
                                vars:
                                  url: https://epr.elastic.co
                              agentless_hello_world.mock_counter:
                                enabled: false
                                vars:
                                  events_per_second: 10
                                  mode: constant
                                  spike_events: 100
                                  spike_every_seconds: 60
                          agentless_hello_world-httpjson:
                            enabled: false
                            streams:
                              agentless_hello_world.generic:
                                enabled: false
                                vars:
                                  url: https://epr.elastic.co
                        name: agentless_hello_world-16
                        namespace: default
                        package:
                          name: agentless_hello_world
                          title: Agentless Hello World
                          version: 0.5.0
                        updated_at: '2026-07-01T16:02:14.067Z'
                        updated_by: admin
                      proposedVersion: 0.5.0
                    - body:
                        message: Agentless policy 9300464c-6cfc-4566-850d-e9e7927457fe not found
                      hasErrors: true
                      id: 9300464c-6cfc-4566-850d-e9e7927457fe
                      statusCode: 404
                    - body:
                        message: Agentless policy 5b8763e9-791a-4038-be29-b384d578200e not found
                      hasErrors: true
                      id: 5b8763e9-791a-4038-be29-b384d578200e
                      statusCode: 404
                upgradeManagedIntegrationsDryRunResponseExample:
                  description: 'Example clean dry-run response (`hasErrors: false`) with the proposed (migrated) policy. `proposedPolicy` is intended for the edit-and-upgrade flow: edit it and submit the edited payload to the update (PUT) endpoint. To apply without edits, use the `_upgrade` endpoint instead.'
                  value:
                    - currentVersion: '1.5.0'
                      hasErrors: false
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      name: ess_billing-1
                      proposedPolicy:
                        created_at: '2025-11-06T18:27:43.541Z'
                        created_by: test_user
                        description: test
                        id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                        inputs:
                          ESS Billing-cel:
                            enabled: true
                            vars:
                              organization_id: '1234'
                        name: ess_billing-1
                        namespace: default
                        package:
                          name: ess_billing
                          title: Elasticsearch Service Billing
                          version: '1.6.0'
                        updated_at: '2025-11-06T18:27:43.541Z'
                        updated_by: test_user
                      proposedVersion: '1.6.0'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/managed_integrations/{policyId}':
    delete:
      tags:
        - Fleet managed integrations
      summary: Delete a managed integration
      description: Delete a managed integration
      operationId: delete-fleet-managed-integrations-policyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: policyId
          in: path
          description: The ID of the policy to delete.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: force
          in: query
          description: Force delete the policy even if the policy is managed.
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                    description: The ID of the deleted managed integration.
                additionalProperties: false
                description: Response for deleting a managed integration.
              examples:
                deleteManagedIntegrationsResponseExample:
                  description: Example response for deleting a managed integration
                  value:
                    item:
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictErrorResponseExample:
                  description: Example of a conflict error response
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet managed integrations
      summary: Get a managed integration
      description: Get a managed integration by ID
      operationId: get-fleet-managed-integrations-policyid
      parameters:
        - name: policyId
          in: path
          description: The ID of the managed integration to retrieve.
          required: true
          schema:
            maxLength: 256
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
              examples:
                getManagedIntegrationResponseExample:
                  description: Example response for getting a managed integration by ID
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: test
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 365
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: false
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: '1.6.0'
                      updated_at: '2025-11-06T18:27:43.541Z'
                      updated_by: test_user
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet managed integrations
      summary: Update a managed integration
      description: 'Update a managed integration by ID. Uses full-replace semantics: the policy is rebuilt entirely from the request body, so any omitted optional field (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is cleared or reset to its default. The integration package name is immutable and the runtime-managed `cluster_id` is preserved from the existing policy.'
      operationId: put-fleet-managed-integrations-policyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: policyId
          in: path
          description: The ID of the managed integration to update.
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_create_managed_integration_request'
            examples:
              updateManagedIntegrationAttachAWSCloudConnectorRequestExample:
                description: 'Example request to attach an AWS cloud connector to a managed integration on update. Because `PUT` is full-replace, the `cloud_connector` block must be present on every subsequent update or the connector is detached.'
                value:
                  cloud_connector:
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS with cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationClearFieldsRequestExample:
                description: 'Example showing full-replace clearing semantics. Compared to the prior state, this request omits `description` (clearing it) and provides only the minimal required fields. Any optional field not present in the body (for example, `description`, `vars`, `global_data_tags`, `cloud_connector`) is dropped from the resulting policy.'
                value:
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.6.0'
              updateManagedIntegrationRequestExample:
                description: 'Example request to update a managed integration. `PUT` uses full-replace semantics: the policy is rebuilt entirely from this body, so any omitted optional field is cleared or reset to its default rather than preserved. For example, omitting `description` clears it, omitting `vars` or `global_data_tags` removes them, and omitting `cloud_connector` detaches any previously attached connector. Detaching or swapping a cloud connector only removes the reference; the connector itself is not deleted, as connectors have an independent, shareable lifecycle and are managed through the cloud connector API. Two fields are exceptions that cannot be changed using `PUT`: the integration `package.name` is immutable, and the runtime-managed `cluster_id` is preserved from the existing agent policy.'
                value:
                  description: updated description
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                          vars:
                            hide_sensitive: true
                            http_client_timeout: 30s
                            lookbehind: 180
                            tags:
                              - forwarded
                              - billing
                        ess_billing.credits:
                          enabled: true
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.6.0'
              updateManagedIntegrationReuseAWSCloudConnectorRequestExample:
                description: Example request to update a managed integration reusing an existing AWS cloud connector by ID instead of creating a new one.
                value:
                  cloud_connector:
                    cloud_connector_id: existing-aws-connector-id
                    enabled: true
                    target_csp: aws
                  description: CSPM integration for AWS reusing existing cloud connector
                  inputs:
                    cspm-cloudbeat/cis_aws:
                      enabled: true
                      streams:
                        cloud_security_posture.findings:
                          enabled: true
                          vars:
                            aws.account_type: organization-account
                            aws.credentials.type: cloud_connector
                            aws.supports_cloud_connectors: true
                            external_id:
                              id: ABCDEFGHIJKLMNOPQRST
                              isSecretRef: true
                            role_arn: arn:aws:iam::123456789012:role/TestRole
                      vars:
                        cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                    cspm-cloudbeat/cis_azure:
                      enabled: false
                    cspm-cloudbeat/cis_gcp:
                      enabled: false
                  name: cspm-aws-policy
                  namespace: default
                  package:
                    name: cloud_security_posture
                    version: '3.1.1'
                  vars:
                    deployment: aws
                    posture: cspm
              updateManagedIntegrationVersionChangeRequestExample:
                description: 'Example request to update a managed integration to a different package version. The package name is immutable, but the version may change.'
                value:
                  description: bumped to a newer package version
                  inputs:
                    ESS Billing-cel:
                      enabled: true
                      streams:
                        ess_billing.billing:
                          enabled: true
                        ess_billing.credits:
                          enabled: false
                      vars:
                        api_key: <REPLACE_WITH_YOUR_API_KEY>
                        organization_id: '1234'
                  name: ess_billing-1
                  namespace: default
                  package:
                    name: ess_billing
                    version: '1.7.0'
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_response'
              examples:
                updateManagedIntegrationResponseExample:
                  description: Example response for updating a managed integration
                  value:
                    item:
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: updated description
                      id: d52a7812-5736-4fdc-aed8-72152afa1ffa
                      inputs:
                        ESS Billing-cel:
                          enabled: true
                          streams:
                            ess_billing.billing:
                              enabled: true
                              vars:
                                hide_sensitive: true
                                http_client_timeout: 30s
                                lookbehind: 180
                                tags:
                                  - forwarded
                                  - billing
                            ess_billing.credits:
                              enabled: true
                          vars:
                            api_key:
                              id: QY1sWpoBbWcMW-edr0Ee
                              isSecretRef: true
                            organization_id: '1234'
                            url: https://billing.elastic-cloud.com
                      name: ess_billing-1
                      namespace: default
                      package:
                        name: ess_billing
                        title: Elasticsearch Service Billing
                        version: '1.6.0'
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                updateManagedIntegrationWithAWSCloudConnectorResponseExample:
                  description: Example response after attaching an AWS cloud connector on update
                  value:
                    item:
                      cloud_connector:
                        cloud_connector_id: aws-connector-67890
                        enabled: true
                      created_at: '2025-11-06T18:27:43.541Z'
                      created_by: test_user
                      description: CSPM integration for AWS with cloud connector
                      id: aws-policy-12345
                      inputs:
                        cspm-cloudbeat/cis_aws:
                          enabled: true
                          streams:
                            cloud_security_posture.findings:
                              enabled: true
                              vars:
                                aws.account_type: organization-account
                                aws.credentials.type: cloud_connector
                                external_id:
                                  id: secret-external-id-123
                                  isSecretRef: true
                                role_arn: arn:aws:iam::123456789012:role/TestRole
                          vars:
                            cloud_formation_template: https://console.aws.amazon.com/cloudformation/home#/stacks/quickcreate?templateURL=https://elastic-cspm-cft.s3.eu-central-1.amazonaws.com/cloudformation-cspm-ACCOUNT_TYPE-9.2.0.yml
                        cspm-cloudbeat/cis_azure:
                          enabled: false
                        cspm-cloudbeat/cis_gcp:
                          enabled: false
                      name: cspm-aws-policy
                      namespace: default
                      package:
                        name: cloud_security_posture
                        title: Cloud Security Posture Management
                        version: '3.1.1'
                      updated_at: '2025-11-07T09:14:02.118Z'
                      updated_by: test_user
                      vars:
                        deployment: aws
                        posture: cspm
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
                packageNameChangeErrorResponseExample:
                  description: The integration package name cannot be changed on update
                  value:
                    error: Bad Request
                    message: Cannot change the integration package of an agentless policy (from "ess_billing" to "cloud_security_posture").
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundErrorResponseExample:
                  description: Example of a not found error response
                  value:
                    message: Agentless policy d52a7812-5736-4fdc-aed8-72152afa1ffa not found
        '409':
          description: 'Conflict — for example, the requested name is already used by another integration policy.'
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictErrorResponseExample:
                  description: Example of a name-conflict error response
                  value:
                    error: Conflict
                    message: An integration policy with the name my-agentless-policy already exists. Please rename it or choose a different name.
                    statusCode: 409
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/message_signing_service/rotate_key_pair:
    post:
      tags:
        - Message Signing Service
      summary: Rotate a Fleet message signing key pair
      description: 'Rotate the key pair used by Fleet to sign messages sent to Elastic Agents. This operation is irreversible and requires all agents in the Fleet to be re-enrolled after rotation. You must explicitly acknowledge the risk by passing `acknowledge=true` as a query parameter.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all AND fleet-agent-policies-all AND fleet-settings-all.'
      operationId: post-fleet-message-signing-service-rotate-key-pair
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: acknowledge
          in: query
          description: Set to true to confirm you understand the risks of rotating the key pair
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Key pair rotated successfully
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                rotateKeyPairSuccessExample:
                  description: The key pair was rotated. All agents must be re-enrolled to receive the new signing key.
                  value:
                    message: Key pair rotated successfully.
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                acknowledgeRequiredExample:
                  description: Request was rejected because the acknowledge query parameter was not set to true
                  value:
                    error: Bad Request
                    message: 'Warning: this API will cause a key pair to rotate and should not be necessary in normal operation.  If you proceed, you may need to reinstall Agents in your network. You must acknowledge the risks of rotating the key pair with acknowledge=true in the request parameters.  For more information, reach out to your administrator.'
                    statusCode: 400
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                serviceUnavailableExample:
                  description: The message signing service is not available
                  value:
                    error: Internal Server Error
                    message: Failed to rotate key pair. Message signing service is unavailable!
                    statusCode: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/outputs:
    get:
      tags:
        - Fleet outputs
      summary: Get outputs
      description: 'List all Fleet outputs.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.'
      operationId: get-fleet-outputs
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      oneOf:
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                      discriminator:
                        propertyName: type
                        mapping:
                          elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                          kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                          logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                          otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                          remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getOutputsExample:
                  description: List of Fleet outputs
                  value:
                    items:
                      - hosts:
                          - https://elasticsearch.example.com:9200
                        id: output-id-1
                        is_default: true
                        is_default_monitoring: true
                        name: Default output
                        type: elasticsearch
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet outputs
      summary: Create output
      description: 'Create a new Fleet output.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: post-fleet-outputs
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_remote_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_logstash'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_kafka'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_new_output_otlp'
              discriminator:
                propertyName: type
                mapping:
                  elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_new_output_elasticsearch'
                  kafka: '#/components/schemas/Kibana_HTTP_APIs_new_output_kafka'
                  logstash: '#/components/schemas/Kibana_HTTP_APIs_new_output_logstash'
                  otlp: '#/components/schemas/Kibana_HTTP_APIs_new_output_otlp'
                  remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_new_output_remote_elasticsearch'
            examples:
              postOutputRequestExample:
                description: Create a new Elasticsearch output
                value:
                  hosts:
                    - https://elasticsearch.example.com:9200
                  is_default: false
                  is_default_monitoring: false
                  name: My output
                  type: elasticsearch
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                    discriminator:
                      propertyName: type
                      mapping:
                        elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                        remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                additionalProperties: false
              examples:
                postOutputExample:
                  description: The created Fleet output
                  value:
                    item:
                      hosts:
                        - https://elasticsearch.example.com:9200
                      id: output-id-2
                      is_default: false
                      is_default_monitoring: false
                      name: My output
                      type: elasticsearch
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/outputs/{outputId}':
    delete:
      tags:
        - Fleet outputs
      summary: Delete output
      description: 'Delete output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: delete-fleet-outputs-outputid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: outputId
          in: path
          description: The ID of the output
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteOutputExample:
                  description: The output was successfully deleted
                  value:
                    id: output-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                notFoundExample:
                  description: No output was found with the given ID
                  value:
                    error: Not Found
                    message: Output output-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet outputs
      summary: Get output
      description: 'Get output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read OR fleet-agent-policies-read.'
      operationId: get-fleet-outputs-outputid
      parameters:
        - name: outputId
          in: path
          description: The ID of the output
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                    discriminator:
                      propertyName: type
                      mapping:
                        elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                        remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                additionalProperties: false
              examples:
                getOutputExample:
                  description: A Fleet output
                  value:
                    item:
                      hosts:
                        - https://elasticsearch.example.com:9200
                      id: output-id-1
                      is_default: true
                      is_default_monitoring: true
                      name: Default output
                      type: elasticsearch
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No output was found with the given ID
                  value:
                    error: Not Found
                    message: Output output-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet outputs
      summary: Update output
      description: 'Update output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: put-fleet-outputs-outputid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: outputId
          in: path
          description: The ID of the output
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_remote_elasticsearch'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_logstash'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_kafka'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_output_otlp'
            examples:
              putOutputRequestExample:
                description: Update a Fleet output
                value:
                  hosts:
                    - https://updated-elasticsearch.example.com:9200
                  name: Updated output
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                    discriminator:
                      propertyName: type
                      mapping:
                        elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_elasticsearch'
                        kafka: '#/components/schemas/Kibana_HTTP_APIs_output_response_kafka'
                        logstash: '#/components/schemas/Kibana_HTTP_APIs_output_response_logstash'
                        otlp: '#/components/schemas/Kibana_HTTP_APIs_output_response_otlp'
                        remote_elasticsearch: '#/components/schemas/Kibana_HTTP_APIs_output_response_remote_elasticsearch'
                additionalProperties: false
              examples:
                putOutputExample:
                  description: The updated Fleet output
                  value:
                    item:
                      hosts:
                        - https://updated-elasticsearch.example.com:9200
                      id: output-id-1
                      is_default: true
                      is_default_monitoring: true
                      name: Updated output
                      type: elasticsearch
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No output was found with the given ID
                  value:
                    error: Not Found
                    message: Output output-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/outputs/{outputId}/health':
    get:
      tags:
        - Fleet outputs
      summary: Get the latest output health
      description: 'Get the latest health status of an output by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.'
      operationId: get-fleet-outputs-outputid-health
      parameters:
        - name: outputId
          in: path
          description: The ID of the output
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - state
                  - message
                  - timestamp
                type: object
                properties:
                  message:
                    type: string
                    description: long message if unhealthy
                  state:
                    type: string
                    description: 'state of output, HEALTHY or DEGRADED'
                  timestamp:
                    type: string
                    description: timestamp of reported state
                additionalProperties: false
              examples:
                getOutputHealthExample:
                  description: The latest health status of a Fleet output
                  value:
                    message: ''
                    state: HEALTHY
                    timestamp: '2024-01-15T10:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies:
    get:
      tags:
        - Fleet package policies
      summary: Get package policies
      description: List all package policies.
      operationId: get-fleet-package-policies
      parameters:
        - name: page
          in: query
          description: Page number
          schema:
            type: number
        - name: perPage
          in: query
          description: Number of results per page
          schema:
            type: number
        - name: sortField
          in: query
          description: Field to sort results by
          schema:
            type: string
        - name: sortOrder
          in: query
          description: 'Sort order, ascending or descending'
          schema:
            enum:
              - desc
              - asc
            type: string
        - name: showUpgradeable
          in: query
          description: 'When true, only show policies with available upgrades'
          schema:
            type: boolean
        - name: kuery
          in: query
          description: A KQL query string to filter results
          schema:
            type: string
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
        - name: withAgentCount
          in: query
          description: 'When true, include the agent count per package policy'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getPackagePoliciesExample:
                  description: List of package policies
                  value:
                    items:
                      - created_at: '2024-01-15T10:00:00.000Z'
                        enabled: true
                        id: package-policy-id-1
                        inputs: [ ]
                        name: nginx-1
                        namespace: default
                        package:
                          name: nginx
                          title: Nginx
                          version: '1.20.0'
                        policy_ids:
                          - agent-policy-id-1
                        updated_at: '2024-01-15T10:00:00.000Z'
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet package policies
      summary: Create a package policy
      description: Create a new package policy and assign it to an agent policy.
      operationId: post-fleet-package-policies
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_create_package_policy_request'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_create_package_policy_request'
              description: You should use inputs as an object and not use the deprecated inputs array.
            examples:
              postPackagePolicyRequestExample:
                description: Create a new nginx package policy
                value:
                  inputs: { }
                  name: nginx-1
                  namespace: default
                  package:
                    name: nginx
                    version: '1.20.0'
                  policy_ids:
                    - agent-policy-id-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_create_package_policy_response'
              examples:
                postPackagePolicyExample:
                  description: The created package policy
                  value:
                    item:
                      created_at: '2024-01-15T10:00:00.000Z'
                      enabled: true
                      id: package-policy-id-2
                      inputs: [ ]
                      name: nginx-1
                      namespace: default
                      package:
                        name: nginx
                        title: Nginx
                        version: '1.20.0'
                      policy_ids:
                        - agent-policy-id-1
                      updated_at: '2024-01-15T10:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '409':
          description: Conflict
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictExample:
                  description: A package policy with the same name already exists
                  value:
                    error: Conflict
                    message: An error message describing what went wrong
                    statusCode: 409
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/_bulk_get:
    post:
      tags:
        - Fleet package policies
      summary: Bulk get package policies
      description: Get multiple package policies by ID.
      operationId: post-fleet-package-policies-bulk-get
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ids
              type: object
              properties:
                ids:
                  maxItems: 1000
                  type: array
                  items:
                    type: string
                  description: list of package policy ids
                ignoreMissing:
                  type: boolean
              additionalProperties: false
            examples:
              postBulkGetPackagePoliciesRequestExample:
                description: Retrieve multiple package policies by ID
                value:
                  ids:
                    - package-policy-id-1
                    - package-policy-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_get_package_policies_response'
              examples:
                postBulkGetPackagePoliciesExample:
                  description: The requested package policies
                  value:
                    items:
                      - created_at: '2024-01-15T10:00:00.000Z'
                        enabled: true
                        id: package-policy-id-1
                        inputs: [ ]
                        name: nginx-1
                        namespace: default
                        package:
                          name: nginx
                          title: Nginx
                          version: '1.20.0'
                        policy_ids:
                          - agent-policy-id-1
                        updated_at: '2024-01-15T10:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundExample:
                  description: One or more package policies were not found
                  value:
                    error: Not Found
                    message: Package policy package-policy-id-2 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/package_policies/{packagePolicyId}':
    delete:
      tags:
        - Fleet package policies
      summary: Delete a package policy
      description: 'Delete a package policy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.'
      operationId: delete-fleet-package-policies-packagepolicyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: packagePolicyId
          in: path
          description: The ID of the package policy
          required: true
          schema:
            type: string
        - name: force
          in: query
          description: 'When true, delete the package policy even if it is managed'
          schema:
            type: boolean
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_one_package_policy_response'
              examples:
                deletePackagePolicyExample:
                  description: The package policy was successfully deleted
                  value:
                    id: package-policy-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet package policies
      summary: Get a package policy
      description: Get a package policy by ID.
      operationId: get-fleet-package-policies-packagepolicyid
      parameters:
        - name: packagePolicyId
          in: path
          description: The ID of the package policy
          required: true
          schema:
            type: string
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
                additionalProperties: false
              examples:
                getPackagePolicyExample:
                  description: A package policy
                  value:
                    item:
                      created_at: '2024-01-15T10:00:00.000Z'
                      enabled: true
                      id: package-policy-id-1
                      inputs: [ ]
                      name: nginx-1
                      namespace: default
                      package:
                        name: nginx
                        title: Nginx
                        version: '1.20.0'
                      policy_ids:
                        - agent-policy-id-1
                      updated_at: '2024-01-15T10:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundExample:
                  description: No package policy was found with the given ID
                  value:
                    error: Not Found
                    message: Package policy package-policy-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet package policies
      summary: Update a package policy
      description: Update a package policy by ID.
      operationId: put-fleet-package-policies-packagepolicyid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: packagePolicyId
          in: path
          description: The ID of the package policy
          required: true
          schema:
            type: string
        - name: format
          in: query
          description: 'Format for the response: simplified or legacy'
          schema:
            enum:
              - simplified
              - legacy
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_update_package_policy_request'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_create_package_policy_request'
            examples:
              putPackagePolicyRequestExample:
                description: Update a package policy
                value:
                  enabled: true
                  inputs: { }
                  name: nginx-1-updated
                  namespace: default
                  package:
                    name: nginx
                    version: '1.20.0'
                  policy_ids:
                    - agent-policy-id-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
                additionalProperties: false
              examples:
                putPackagePolicyExample:
                  description: The updated package policy
                  value:
                    item:
                      created_at: '2024-01-15T10:00:00.000Z'
                      enabled: true
                      id: package-policy-id-1
                      inputs: [ ]
                      name: nginx-1-updated
                      namespace: default
                      package:
                        name: nginx
                        title: Nginx
                        version: '1.20.0'
                      policy_ids:
                        - agent-policy-id-1
                      updated_at: '2024-01-15T11:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '403':
          description: Forbidden
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                forbiddenExample:
                  description: The update is not authorized for this package
                  value:
                    error: Forbidden
                    message: An error message describing what went wrong
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/delete:
    post:
      tags:
        - Fleet package policies
      summary: Bulk delete package policies
      description: 'Delete multiple package policies by ID.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.'
      operationId: post-fleet-package-policies-delete
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_policies_request'
            examples:
              postDeletePackagePoliciesRequestExample:
                description: Delete multiple package policies by ID
                value:
                  packagePolicyIds:
                    - package-policy-id-1
                    - package-policy-id-2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_delete_package_policies_response_item'
              examples:
                postDeletePackagePoliciesExample:
                  description: Results of the bulk delete operation
                  value:
                    - id: package-policy-id-1
                      success: true
                    - id: package-policy-id-2
                      success: true
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/upgrade:
    post:
      tags:
        - Fleet package policies
      summary: Upgrade a package policy
      description: 'Upgrade a package policy to a newer package version.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-all AND integrations-all.'
      operationId: post-fleet-package-policies-upgrade
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_upgrade_package_policies_request'
            examples:
              postUpgradePackagePoliciesRequestExample:
                description: Upgrade package policies to the latest version
                value:
                  packagePolicyIds:
                    - package-policy-id-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_status_response'
              examples:
                postUpgradePackagePoliciesExample:
                  description: Results of the upgrade operation
                  value:
                    - id: package-policy-id-1
                      name: nginx-1
                      success: true
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/package_policies/upgrade/dryrun:
    post:
      tags:
        - Fleet package policies
      summary: Dry run a package policy upgrade
      description: 'Preview the changes that would be applied by upgrading a package policy to a newer package version.<br/><br/>[Required authorization] Route required privileges: fleet-agent-policies-read AND integrations-read.'
      operationId: post-fleet-package-policies-upgrade-dryrun
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_dry_run_package_policies_request'
            examples:
              postDryRunPackagePoliciesRequestExample:
                description: Dry run an upgrade of a package policy
                value:
                  packagePolicyIds:
                    - package-policy-id-1
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                maxItems: 10000
                type: array
                items:
                  required:
                    - hasErrors
                  type: object
                  properties:
                    agent_diff:
                      maxItems: 1
                      type: array
                      items:
                        maxItems: 10000
                        type: array
                        items:
                          required:
                            - id
                            - name
                            - revision
                            - type
                            - data_stream
                            - use_output
                            - package_policy_id
                          type: object
                          properties:
                            data_stream:
                              required:
                                - namespace
                              type: object
                              properties:
                                namespace:
                                  type: string
                            id:
                              type: string
                            meta:
                              required:
                                - package
                              type: object
                              properties:
                                package:
                                  required:
                                    - name
                                    - version
                                  type: object
                                  properties:
                                    name:
                                      type: string
                                    version:
                                      type: string
                            name:
                              type: string
                            package_policy_id:
                              type: string
                            processors:
                              maxItems: 10000
                              type: array
                              items:
                                required:
                                  - add_fields
                                type: object
                                properties:
                                  add_fields:
                                    required:
                                      - target
                                      - fields
                                    type: object
                                    properties:
                                      fields:
                                        type: object
                                        additionalProperties:
                                          type:
                                            - number
                                            - string
                                      target:
                                        type: string
                            revision:
                              type: number
                            streams:
                              maxItems: 10000
                              type: array
                              items:
                                required:
                                  - data_stream
                                type: object
                                properties:
                                  data_stream:
                                    required:
                                      - dataset
                                    type: object
                                    properties:
                                      dataset:
                                        type: string
                                      type:
                                        type: string
                                  id:
                                    type: string
                            type:
                              type: string
                            use_output:
                              type: string
                    body:
                      required:
                        - message
                      type: object
                      properties:
                        message:
                          type: string
                      additionalProperties: false
                    diff:
                      maxItems: 2
                      type: array
                      items:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_dry_run_package_policy_response'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_dry_run_package_policy'
                    hasErrors:
                      type: boolean
                    name:
                      type: string
                    statusCode:
                      type: number
                  additionalProperties: false
              examples:
                postDryRunPackagePoliciesExample:
                  description: Preview of the package policy upgrade diff
                  value:
                    - diff:
                        - id: package-policy-id-1
                          name: nginx-1
                          package:
                            name: nginx
                            version: '1.20.0'
                        - name: nginx-1
                          package:
                            name: nginx
                            version: '1.21.0'
                      hasErrors: false
                      name: nginx-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/proxies:
    get:
      tags:
        - Fleet proxies
      summary: Get proxies
      description: 'List all Fleet proxies.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.'
      operationId: get-fleet-proxies
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - url
                        - name
                      type: object
                      properties:
                        certificate:
                          type:
                            - 'null'
                            - string
                        certificate_authorities:
                          type:
                            - 'null'
                            - string
                        certificate_key:
                          type:
                            - 'null'
                            - string
                        id:
                          type: string
                        is_preconfigured:
                          type: boolean
                          default: false
                        name:
                          type: string
                        proxy_headers:
                          type:
                            - 'null'
                            - object
                          additionalProperties:
                            type:
                              - boolean
                              - number
                              - string
                        url:
                          type: string
                      additionalProperties: false
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getFleetProxiesExample:
                  description: List of Fleet proxies
                  value:
                    items:
                      - id: proxy-id-1
                        is_preconfigured: false
                        name: My proxy
                        url: http://proxy.example.com:3128
                    page: 1
                    perPage: 20
                    total: 1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Fleet proxies
      summary: Create a proxy
      description: 'Create a new Fleet proxy.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: post-fleet-proxies
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - url
                - name
              type: object
              properties:
                certificate:
                  type:
                    - 'null'
                    - string
                certificate_authorities:
                  type:
                    - 'null'
                    - string
                certificate_key:
                  type:
                    - 'null'
                    - string
                id:
                  type: string
                is_preconfigured:
                  type: boolean
                  default: false
                name:
                  type: string
                proxy_headers:
                  type:
                    - 'null'
                    - object
                  additionalProperties:
                    type:
                      - boolean
                      - number
                      - string
                url:
                  type: string
              additionalProperties: false
            examples:
              postFleetProxyRequestExample:
                description: Create a new Fleet proxy
                value:
                  name: My proxy
                  url: http://proxy.example.com:3128
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - url
                      - name
                    type: object
                    properties:
                      certificate:
                        type:
                          - 'null'
                          - string
                      certificate_authorities:
                        type:
                          - 'null'
                          - string
                      certificate_key:
                        type:
                          - 'null'
                          - string
                      id:
                        type: string
                      is_preconfigured:
                        type: boolean
                        default: false
                      name:
                        type: string
                      proxy_headers:
                        type:
                          - 'null'
                          - object
                        additionalProperties:
                          type:
                            - boolean
                            - number
                            - string
                      url:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                postFleetProxyExample:
                  description: The created Fleet proxy
                  value:
                    item:
                      id: proxy-id-2
                      is_preconfigured: false
                      name: My proxy
                      url: http://proxy.example.com:3128
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/proxies/{itemId}':
    delete:
      tags:
        - Fleet proxies
      summary: Delete a proxy
      description: 'Delete a proxy by ID<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: delete-fleet-proxies-itemid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: itemId
          in: path
          description: The ID of the proxy
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
              examples:
                deleteFleetProxyExample:
                  description: The Fleet proxy was successfully deleted
                  value:
                    id: proxy-id-1
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No proxy was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet proxy proxy-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Fleet proxies
      summary: Get a proxy
      description: 'Get a proxy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.'
      operationId: get-fleet-proxies-itemid
      parameters:
        - name: itemId
          in: path
          description: The ID of the proxy
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - url
                      - name
                    type: object
                    properties:
                      certificate:
                        type:
                          - 'null'
                          - string
                      certificate_authorities:
                        type:
                          - 'null'
                          - string
                      certificate_key:
                        type:
                          - 'null'
                          - string
                      id:
                        type: string
                      is_preconfigured:
                        type: boolean
                        default: false
                      name:
                        type: string
                      proxy_headers:
                        type:
                          - 'null'
                          - object
                        additionalProperties:
                          type:
                            - boolean
                            - number
                            - string
                      url:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getFleetProxyExample:
                  description: A Fleet proxy
                  value:
                    item:
                      id: proxy-id-1
                      is_preconfigured: false
                      name: My proxy
                      url: http://proxy.example.com:3128
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No proxy was found with the given ID
                  value:
                    error: Not Found
                    message: Fleet proxy proxy-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet proxies
      summary: Update a proxy
      description: 'Update a proxy by ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: put-fleet-proxies-itemid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: itemId
          in: path
          description: The ID of the proxy
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                certificate:
                  type:
                    - 'null'
                    - string
                  default: 'null'
                certificate_authorities:
                  type:
                    - 'null'
                    - string
                  default: 'null'
                certificate_key:
                  type:
                    - 'null'
                    - string
                  default: 'null'
                name:
                  type: string
                proxy_headers:
                  type:
                    - 'null'
                    - object
                  additionalProperties:
                    type:
                      - boolean
                      - number
                      - string
                url:
                  type: string
              additionalProperties: false
            examples:
              putFleetProxyRequestExample:
                description: Update a Fleet proxy
                value:
                  name: Updated proxy
                  url: http://updated-proxy.example.com:3128
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - url
                      - name
                    type: object
                    properties:
                      certificate:
                        type:
                          - 'null'
                          - string
                      certificate_authorities:
                        type:
                          - 'null'
                          - string
                      certificate_key:
                        type:
                          - 'null'
                          - string
                      id:
                        type: string
                      is_preconfigured:
                        type: boolean
                        default: false
                      name:
                        type: string
                      proxy_headers:
                        type:
                          - 'null'
                          - object
                        additionalProperties:
                          type:
                            - boolean
                            - number
                            - string
                      url:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                putFleetProxyExample:
                  description: The updated Fleet proxy
                  value:
                    item:
                      id: proxy-id-1
                      is_preconfigured: false
                      name: Updated proxy
                      url: http://updated-proxy.example.com:3128
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No proxy was found with the given ID
                  value:
                    error: Not Found
                    message: Proxy proxy-id-1 not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/remote_synced_integrations/{outputId}/remote_status':
    get:
      tags:
        - Fleet remote synced integrations
      summary: Get remote synced integrations status by outputId
      description: 'Get the synchronization status of remote integrations for a specific output by its ID.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.'
      operationId: get-fleet-remote-synced-integrations-outputid-remote-status
      parameters:
        - name: outputId
          in: path
          description: The ID of the output
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - integrations
                type: object
                properties:
                  custom_assets:
                    type: object
                    additionalProperties:
                      required:
                        - type
                        - name
                        - package_name
                        - package_version
                        - sync_status
                      type: object
                      properties:
                        error:
                          type: string
                        is_deleted:
                          type: boolean
                        name:
                          type: string
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        type:
                          type: string
                        warning:
                          required:
                            - title
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                  error:
                    type: string
                  integrations:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - sync_status
                        - install_status
                      type: object
                      properties:
                        error:
                          type: string
                        id:
                          type: string
                        install_status:
                          required:
                            - main
                          type: object
                          properties:
                            main:
                              type: string
                            remote:
                              type: string
                          additionalProperties: false
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        updated_at:
                          type: string
                        warning:
                          required:
                            - title
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                  warning:
                    required:
                      - title
                    type: object
                    properties:
                      message:
                        type: string
                      title:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getRemoteSyncedIntegrationsInfoExample:
                  description: Synchronization status of remote integrations for a specific output
                  value:
                    integrations:
                      - id: nginx-remote
                        install_status:
                          main: installed
                          remote: installed
                        package_name: nginx
                        package_version: '1.20.0'
                        sync_status: COMPLETED
                        updated_at: '2024-01-01T00:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/remote_synced_integrations/status:
    get:
      tags:
        - Fleet remote synced integrations
      summary: Get remote synced integrations status
      description: 'Get the synchronization status of all remote integrations across connected remote clusters.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read AND integrations-read.'
      operationId: get-fleet-remote-synced-integrations-status
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - integrations
                type: object
                properties:
                  custom_assets:
                    type: object
                    additionalProperties:
                      required:
                        - type
                        - name
                        - package_name
                        - package_version
                        - sync_status
                      type: object
                      properties:
                        error:
                          type: string
                        is_deleted:
                          type: boolean
                        name:
                          type: string
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        type:
                          type: string
                        warning:
                          required:
                            - title
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                  error:
                    type: string
                  integrations:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - sync_status
                        - install_status
                      type: object
                      properties:
                        error:
                          type: string
                        id:
                          type: string
                        install_status:
                          required:
                            - main
                          type: object
                          properties:
                            main:
                              type: string
                            remote:
                              type: string
                          additionalProperties: false
                        package_name:
                          type: string
                        package_version:
                          type: string
                        sync_status:
                          enum:
                            - completed
                            - synchronizing
                            - failed
                            - warning
                          type: string
                        updated_at:
                          type: string
                        warning:
                          required:
                            - title
                          type: object
                          properties:
                            message:
                              type: string
                            title:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                  warning:
                    required:
                      - title
                    type: object
                    properties:
                      message:
                        type: string
                      title:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getRemoteSyncedIntegrationsStatusExample:
                  description: Synchronization status of remote integrations across connected remote clusters
                  value:
                    integrations:
                      - id: nginx-remote
                        install_status:
                          main: installed
                          remote: installed
                        package_name: nginx
                        package_version: '1.20.0'
                        sync_status: COMPLETED
                        updated_at: '2024-01-01T00:00:00.000Z'
                      - error: Failed to sync package to remote cluster
                        id: system-remote
                        install_status:
                          main: installed
                          remote: not_installed
                        package_name: system
                        package_version: 1.38.0
                        sync_status: FAILED
                        updated_at: '2024-01-01T00:00:00.000Z'
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/service_tokens:
    post:
      tags:
        - Fleet service tokens
      summary: Create a service token
      description: 'Create a Fleet Server service token. The token is used to enroll Fleet Server instances with Kibana.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-service-tokens
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type:
                - 'null'
                - object
              properties:
                remote:
                  type: boolean
                  default: false
              additionalProperties: false
              default: 'null'
            examples:
              postGenerateServiceTokenRequestExample:
                description: Generate a service token for a remote Fleet Server
                value:
                  remote: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - name
                  - value
                type: object
                properties:
                  name:
                    type: string
                  value:
                    type: string
                additionalProperties: false
              examples:
                postGenerateServiceTokenExample:
                  description: The generated Fleet Server service token
                  value:
                    name: elastic/fleet-server/token-1234567890
                    value: AAEAAWVsYXN0aWMvZmxlZXQtc2VydmVyL3Rva2VuLTEyMzQ1Njc4OTA6QUJDREVGR0hJSktMTU5P
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/settings:
    get:
      tags:
        - Fleet internals
      summary: Get settings
      description: 'Get the global Fleet settings.<br/><br/>[Required authorization] Route required privileges: fleet-settings-read.'
      operationId: get-fleet-settings
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    type: object
                    properties:
                      action_secret_storage_requirements_met:
                        type: boolean
                      delete_unenrolled_agents:
                        required:
                          - enabled
                          - is_preconfigured
                        type: object
                        properties:
                          enabled:
                            type: boolean
                          is_preconfigured:
                            type: boolean
                        additionalProperties: false
                      download_source_auth_secret_storage_requirements_met:
                        type: boolean
                      has_seen_add_data_notice:
                        type: boolean
                      id:
                        type: string
                      ilm_migration_status:
                        type: object
                        properties:
                          logs:
                            enum:
                              - success
                              - 'null'
                            type:
                              - 'null'
                              - string
                          metrics:
                            enum:
                              - success
                              - 'null'
                            type:
                              - 'null'
                              - string
                          synthetics:
                            enum:
                              - success
                              - 'null'
                            type:
                              - 'null'
                              - string
                        additionalProperties: false
                      integration_knowledge_enabled:
                        type: boolean
                      otlp_output_requirements_met:
                        type: boolean
                      output_secret_storage_requirements_met:
                        type: boolean
                      preconfigured_fields:
                        maxItems: 1
                        type: array
                        items:
                          enum:
                            - fleet_server_hosts
                          type: string
                      prerelease_integrations_enabled:
                        type: boolean
                      secret_storage_requirements_met:
                        type: boolean
                      ssl_secret_storage_requirements_met:
                        type: boolean
                      use_space_awareness_migration_started_at:
                        type:
                          - 'null'
                          - string
                      use_space_awareness_migration_status:
                        enum:
                          - pending
                          - success
                          - error
                        type: string
                      version:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getSettingsExample:
                  description: The current Fleet settings
                  value:
                    item:
                      delete_unenrolled_agents:
                        enabled: false
                        is_preconfigured: false
                      has_seen_add_data_notice: true
                      id: fleet-default-settings
                      otlp_output_requirements_met: true
                      output_secret_storage_requirements_met: true
                      prerelease_integrations_enabled: false
                      secret_storage_requirements_met: true
                      version: WzEsMV0=
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundExample:
                  description: Fleet settings have not been initialized
                  value:
                    error: Not Found
                    message: Settings not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet internals
      summary: Update settings
      description: 'Update the global Fleet settings.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: put-fleet-settings
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                additional_yaml_config:
                  type: string
                  deprecated: true
                delete_unenrolled_agents:
                  required:
                    - enabled
                    - is_preconfigured
                  type: object
                  properties:
                    enabled:
                      type: boolean
                    is_preconfigured:
                      type: boolean
                  additionalProperties: false
                has_seen_add_data_notice:
                  type: boolean
                  deprecated: true
                integration_knowledge_enabled:
                  type: boolean
                kibana_ca_sha256:
                  type: string
                  deprecated: true
                kibana_urls:
                  maxItems: 10
                  type: array
                  items:
                    type: string
                    format: uri
                  deprecated: true
                prerelease_integrations_enabled:
                  type: boolean
              additionalProperties: false
            examples:
              putSettingsRequestExample:
                description: Update Fleet settings to enable pre-release integrations
                value:
                  prerelease_integrations_enabled: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    type: object
                    properties:
                      action_secret_storage_requirements_met:
                        type: boolean
                      delete_unenrolled_agents:
                        required:
                          - enabled
                          - is_preconfigured
                        type: object
                        properties:
                          enabled:
                            type: boolean
                          is_preconfigured:
                            type: boolean
                        additionalProperties: false
                      download_source_auth_secret_storage_requirements_met:
                        type: boolean
                      has_seen_add_data_notice:
                        type: boolean
                      id:
                        type: string
                      ilm_migration_status:
                        type: object
                        properties:
                          logs:
                            enum:
                              - success
                              - 'null'
                            type:
                              - 'null'
                              - string
                          metrics:
                            enum:
                              - success
                              - 'null'
                            type:
                              - 'null'
                              - string
                          synthetics:
                            enum:
                              - success
                              - 'null'
                            type:
                              - 'null'
                              - string
                        additionalProperties: false
                      integration_knowledge_enabled:
                        type: boolean
                      otlp_output_requirements_met:
                        type: boolean
                      output_secret_storage_requirements_met:
                        type: boolean
                      preconfigured_fields:
                        maxItems: 1
                        type: array
                        items:
                          enum:
                            - fleet_server_hosts
                          type: string
                      prerelease_integrations_enabled:
                        type: boolean
                      secret_storage_requirements_met:
                        type: boolean
                      ssl_secret_storage_requirements_met:
                        type: boolean
                      use_space_awareness_migration_started_at:
                        type:
                          - 'null'
                          - string
                      use_space_awareness_migration_status:
                        enum:
                          - pending
                          - success
                          - error
                        type: string
                      version:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                putSettingsExample:
                  description: The updated Fleet settings
                  value:
                    item:
                      delete_unenrolled_agents:
                        enabled: false
                        is_preconfigured: false
                      has_seen_add_data_notice: true
                      id: fleet-default-settings
                      otlp_output_requirements_met: true
                      output_secret_storage_requirements_met: true
                      prerelease_integrations_enabled: true
                      secret_storage_requirements_met: true
                      version: WzIsMV0=
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                notFoundExample:
                  description: Fleet settings have not been initialized
                  value:
                    error: Not Found
                    message: Settings not found
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/setup:
    post:
      tags:
        - Fleet internals
      summary: Initiate Fleet setup
      description: 'Initialize Fleet and create the necessary Elasticsearch resources for Fleet to operate. Safe to call multiple times (idempotent). Returns the initialization status and any non-fatal errors encountered during setup.<br/><br/>[Required authorization] Route required privileges: fleet-agents-read OR fleet-agent-policies-read OR fleet-settings-read OR fleet-setup.'
      operationId: post-fleet-setup
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      responses:
        '200':
          description: Fleet setup completed
          content:
            application/json:
              schema:
                required:
                  - isInitialized
                  - nonFatalErrors
                type: object
                properties:
                  isInitialized:
                    type: boolean
                  nonFatalErrors:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - name
                        - message
                      type: object
                      properties:
                        message:
                          type: string
                        name:
                          type: string
                      additionalProperties: false
                additionalProperties: false
                description: 'A summary of the result of Fleet''s `setup` lifecycle. If `isInitialized` is true, Fleet is ready to accept agent enrollment. `nonFatalErrors` may include useful insight into non-blocking issues with Fleet setup.'
              examples:
                fleetSetupSuccessExample:
                  description: Fleet initialized successfully with no non-fatal errors
                  value:
                    isInitialized: true
                    nonFatalErrors: [ ]
                fleetSetupWithNonFatalErrorsExample:
                  description: Fleet initialized but encountered non-fatal errors during setup
                  value:
                    isInitialized: true
                    nonFatalErrors:
                      - message: Package fleet_server not found in registry
                        name: PackageNotFoundError
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '500':
          description: Internal Server Error
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
                description: Internal Server Error
              examples:
                internalErrorResponseExample:
                  description: Example of an internal server error response
                  value:
                    error: Internal Server Error
                    message: An error message describing what went wrong
                    statusCode: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/space_settings:
    get:
      tags:
        - Fleet internals
      summary: Get space settings
      description: Get the Fleet settings for the current Kibana space.
      operationId: get-fleet-space-settings
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - allowed_namespace_prefixes
                    type: object
                    properties:
                      allowed_namespace_prefixes:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      managed_by:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getSpaceSettingsExample:
                  description: The Fleet settings for the current Kibana space
                  value:
                    item:
                      allowed_namespace_prefixes:
                        - team-a
                        - team-b
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Fleet internals
      summary: Create space settings
      description: 'Create or update Fleet settings for the current Kibana space.<br/><br/>[Required authorization] Route required privileges: fleet-settings-all.'
      operationId: put-fleet-space-settings
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                allowed_namespace_prefixes:
                  maxItems: 10
                  type: array
                  items:
                    type: string
              additionalProperties: false
            examples:
              putSpaceSettingsRequestExample:
                description: Update allowed namespace prefixes for the current Kibana space
                value:
                  allowed_namespace_prefixes:
                    - team-a
                    - team-b
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - allowed_namespace_prefixes
                    type: object
                    properties:
                      allowed_namespace_prefixes:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      managed_by:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                putSpaceSettingsExample:
                  description: The updated Fleet settings for the current Kibana space
                  value:
                    item:
                      allowed_namespace_prefixes:
                        - team-a
                        - team-b
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/fleet/uninstall_tokens:
    get:
      tags:
        - Fleet uninstall tokens
      summary: Get metadata for latest uninstall tokens
      description: 'List the metadata for the latest uninstall tokens per agent policy.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: get-fleet-uninstall-tokens
      parameters:
        - name: policyId
          in: query
          description: Partial match filtering for policy IDs
          schema:
            maxLength: 50
            type: string
        - name: search
          in: query
          description: Partial match filtering for uninstall token values
          schema:
            maxLength: 50
            type: string
        - name: perPage
          in: query
          description: The number of items to return
          schema:
            minimum: 5
            type: number
        - name: page
          in: query
          description: Page number
          schema:
            minimum: 1
            type: number
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - items
                  - total
                  - page
                  - perPage
                type: object
                properties:
                  items:
                    maxItems: 10000
                    type: array
                    items:
                      required:
                        - id
                        - policy_id
                        - created_at
                      type: object
                      properties:
                        created_at:
                          type: string
                        id:
                          type: string
                        namespaces:
                          maxItems: 100
                          type: array
                          items:
                            type: string
                        policy_id:
                          type: string
                        policy_name:
                          type:
                            - 'null'
                            - string
                      additionalProperties: false
                  page:
                    type: number
                  perPage:
                    type: number
                  total:
                    type: number
                additionalProperties: false
              examples:
                getUninstallTokensExample:
                  description: List of uninstall token metadata for agent policies
                  value:
                    items:
                      - created_at: '2024-01-01T00:00:00.000Z'
                        id: token-id-1
                        namespaces:
                          - default
                        policy_id: policy-id-1
                        policy_name: Default policy
                      - created_at: '2024-01-02T00:00:00.000Z'
                        id: token-id-2
                        namespaces:
                          - production
                        policy_id: policy-id-2
                        policy_name: Production policy
                    page: 1
                    perPage: 20
                    total: 2
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                conflictingQueryParamsExample:
                  description: Both policyId and search query parameters were provided
                  value:
                    error: Bad Request
                    message: Query parameters `policyId` and `search` cannot be used at the same time.
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/uninstall_tokens/{agentPolicyId}/rotate':
    post:
      tags:
        - Fleet uninstall tokens
      summary: Rotate an uninstall token
      description: 'Rotate the uninstall token for an agent policy. Only applicable to policies with tamper protection enabled.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: post-fleet-uninstall-tokens-agentpolicyid-rotate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: agentPolicyId
          in: path
          description: The ID of the agent policy whose uninstall token should be rotated
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              examples:
                rotateUninstallTokenExample:
                  description: Uninstall token rotated successfully for the given agent policy
                  value:
                    message: Uninstall token rotated successfully.
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
                notProtectedExample:
                  description: Agent policy does not have tamper protection enabled
                  value:
                    error: Bad Request
                    message: 'Agent policy [policy-id-1] does not have tamper protection enabled. Uninstall tokens can only be rotated for protected policies.'
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                notFoundExample:
                  description: No agent policy was found with the given ID
                  value:
                    error: Not Found
                    message: Agent policy not found with id policy-id-1
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/fleet/uninstall_tokens/{uninstallTokenId}':
    get:
      tags:
        - Fleet uninstall tokens
      summary: Get a decrypted uninstall token
      description: 'Get one decrypted uninstall token by its ID.<br/><br/>[Required authorization] Route required privileges: fleet-agents-all.'
      operationId: get-fleet-uninstall-tokens-uninstalltokenid
      parameters:
        - name: uninstallTokenId
          in: path
          description: The ID of the uninstall token
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - item
                type: object
                properties:
                  item:
                    required:
                      - id
                      - policy_id
                      - created_at
                      - token
                    type: object
                    properties:
                      created_at:
                        type: string
                      id:
                        type: string
                      namespaces:
                        maxItems: 100
                        type: array
                        items:
                          type: string
                      policy_id:
                        type: string
                      policy_name:
                        type:
                          - 'null'
                          - string
                      token:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              examples:
                getUninstallTokenExample:
                  description: Decrypted uninstall token for an agent policy
                  value:
                    item:
                      created_at: '2024-01-01T00:00:00.000Z'
                      id: token-id-1
                      namespaces:
                        - default
                      policy_id: policy-id-1
                      policy_name: Default policy
                      token: CKHJsJcBqNwIRcRBNDaE
        '400':
          description: Bad Request
          content:
            application/json:
              schema:
                required:
                  - message
                  - attributes
                type: object
                properties:
                  attributes: { }
                  error:
                    type: string
                  errorType:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
                additionalProperties: false
                description: Generic Error
              examples:
                genericErrorResponseExample:
                  description: Example of a generic error response
                  value:
                    error: Bad Request
                    message: An error message describing what went wrong
                    statusCode: 400
        '404':
          description: Not Found
          content:
            application/json:
              examples:
                notFoundExample:
                  description: No uninstall token was found with the given ID
                  value:
                    error: Not Found
                    message: Uninstall Token not found with ID token-id-1
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/links:
    get:
      tags:
        - Links
      summary: List links library items
      description: 'Returns a paginated list of links library items. Each result includes title, description, and metadata. Use `GET /api/links/{id}` to retrieve the complete state.'
      operationId: get-links
      parameters:
        - name: page
          in: query
          description: The page of results to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of results to return per page.
          schema:
            maximum: 1000
            minimum: 1
            type: number
            default: 20
        - name: query
          in: query
          description: 'Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.'
          schema:
            type: string
        - name: tags
          in: query
          description: 'A tag ID to include. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are included.'
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 250
              type: string
            description: Tag IDs associated with this dashboard.
            default: [ ]
        - name: excluded_tags
          in: query
          description: 'A tag ID to exclude. Accepts a single tag ID or multiple tag IDs. When multiple are specified, library items matching any of the tag IDs are excluded.'
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 250
              type: string
            description: Tag IDs associated with this dashboard.
            default: [ ]
        - name: tag_names
          in: query
          description: 'A tag name to include. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are included. If the same name is shared by multiple tags, items matching any of those tags are included.'
          schema:
            maxItems: 100
            type: array
            items:
              type: string
            x-state: Generally available; added in 9.6.0
        - name: excluded_tag_names
          in: query
          description: 'A tag name to exclude. Accepts a single tag name or multiple tag names. When multiple are specified, library items matching any of the tag names are excluded. If the same name is shared by multiple tags, items matching any of those tags are excluded.'
          schema:
            maxItems: 100
            type: array
            items:
              type: string
            x-state: Generally available; added in 9.6.0
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - data
                  - meta
                type: object
                properties:
                  data:
                    maxItems: 1000
                    minItems: 0
                    type: array
                    items:
                      required:
                        - id
                        - data
                        - meta
                      type: object
                      properties:
                        data:
                          required:
                            - title
                          type: object
                          properties:
                            description:
                              maxLength: 10000
                              type: string
                              description: A short description of the links library item.
                            title:
                              maxLength: 1000
                              type: string
                              description: The links library item title.
                          additionalProperties: false
                        id:
                          maxLength: 250
                          type: string
                        meta:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                      additionalProperties: false
                    description: List of links library items matching the query.
                  meta:
                    required:
                      - total
                    type: object
                    properties:
                      page:
                        minimum: 1
                        type: number
                        description: The returned page of results.
                        default: 1
                      per_page:
                        maximum: 1000
                        minimum: 1
                        type: number
                        description: The number of results returned per page.
                        default: 20
                      total:
                        type: number
                        description: The total number of results matching the query.
                    additionalProperties: false
                additionalProperties: false
              examples:
                searchLinks:
                  summary: Search links library items response
                  description: 'Returns a paginated list of links library items. Each result includes title, description, and metadata. Use `GET /api/links/{id}` to retrieve the complete state.'
                  value:
                    data:
                      - data:
                          description: A collection of important links
                          title: Important Resources
                        id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                        meta:
                          created_at: '2026-06-03T23:33:39.979Z'
                          created_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                          managed: false
                          updated_at: '2026-06-03T23:33:39.979Z'
                          updated_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                          version: WzEwNywxXQ==
                    meta:
                      page: 1
                      per_page: 20
                      total: 1
        '403':
          description: forbidden
      x-codeSamples:
        - label: Search links library items - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/links?query=welcome&per_page=10\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Search links library items - Console
          lang: Console
          source: "GET kbn:/api/links?query=welcome&per_page=10\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Links
      summary: Create a links library item
      description: 'Creates a new links library item and returns its ID, full state, and metadata.'
      operationId: post-links
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - links
                - title
              type: object
              properties:
                description:
                  type: string
                layout:
                  enum:
                    - horizontal
                    - vertical
                  type: string
                  description: Whether to display the links in a horizontal or vertical layout.
                links:
                  maxItems: 100
                  type: array
                  items:
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                    discriminator:
                      propertyName: type
                      mapping:
                        dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                        externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                  description: The list of links to display.
                tags:
                  maxItems: 1000
                  type: array
                  items:
                    maxLength: 250
                    type: string
                  description: Tag IDs associated with this library item.
                  default: [ ]
                title:
                  type: string
              additionalProperties: false
            examples:
              createLinks:
                summary: Create a links library item
                value:
                  description: A collection of important links
                  layout: horizontal
                  links:
                    - destination: dashboard-abc-123
                      label: Overview
                      type: dashboardLink
                    - destination: https://www.elastic.co/docs
                      label: Elastic Documentation
                      type: externalLink
                  title: Important Resources
      responses:
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    required:
                      - links
                      - title
                    type: object
                    properties:
                      description:
                        type: string
                      layout:
                        enum:
                          - horizontal
                          - vertical
                        type: string
                        description: Whether to display the links in a horizontal or vertical layout.
                      links:
                        maxItems: 100
                        type: array
                        items:
                          oneOf:
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                          discriminator:
                            propertyName: type
                            mapping:
                              dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                              externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                        description: The list of links to display.
                      tags:
                        maxItems: 1000
                        type: array
                        items:
                          maxLength: 250
                          type: string
                        description: Tag IDs associated with this library item.
                        default: [ ]
                      title:
                        type: string
                    additionalProperties: false
                  id:
                    type: string
                    description: 'The unique ID of the links library item, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                createLinks:
                  summary: Create links library item response
                  description: 'Creates a new links library item and returns its ID, full state, and metadata.'
                  value:
                    data:
                      description: A collection of important links
                      layout: horizontal
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-06-03T23:33:39.979Z'
                      created_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                      managed: false
                      updated_at: '2026-06-03T23:33:39.979Z'
                      updated_by: u_EWATCHX9oIEsmcXj8aA1FkcaY3DE-XEpsiGTjrR2PmM_0
                      version: WzEwNywxXQ==
        '400':
          description: invalid request
        '403':
          description: forbidden
      x-codeSamples:
        - label: Create a links library item - cURL
          lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/links\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Important Resources\",\n  \"description\": \"A collection of important links\",\n  \"links\": [\n    {\n      \"label\": \"Overview\",\n      \"type\": \"dashboardLink\",\n      \"destination\": \"dashboard-abc-123\"\n    },\n    {\n      \"label\": \"Elastic Documentation\",\n      \"type\": \"externalLink\",\n      \"destination\": \"https://www.elastic.co/docs\"\n    }\n  ],\n  \"layout\": \"horizontal\"\n}'"
        - label: Create a links library item - Console
          lang: Console
          source: "POST kbn:/api/links\n{\n  \"summary\": \"Create a links library item\",\n  \"value\": {\n    \"title\": \"Important Resources\",\n    \"description\": \"A collection of important links\",\n    \"links\": [\n      {\n        \"label\": \"Overview\",\n        \"type\": \"dashboardLink\",\n        \"destination\": \"dashboard-abc-123\"\n      },\n      {\n        \"label\": \"Elastic Documentation\",\n        \"type\": \"externalLink\",\n        \"destination\": \"https://www.elastic.co/docs\"\n      }\n    ],\n    \"layout\": \"horizontal\"\n  }\n}\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/links/{id}':
    delete:
      tags:
        - Links
      summary: Delete a links library item
      description: Permanently deletes a links library item by ID.
      operationId: delete-links-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The unique ID of the links library item, as returned by the create or search endpoints.'
          required: true
          schema:
            maxLength: 250
            type: string
      responses:
        '204':
          description: 'No content, the links library item was successfully deleted.'
        '400':
          description: invalid request
        '403':
          description: forbidden
        '404':
          description: A links library item with the given ID was not found.
      x-codeSamples:
        - label: Delete a links library item - cURL
          lang: cURL
          source: "curl -X DELETE \"${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - label: Delete a links library item - Console
          lang: Console
          source: "DELETE kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Links
      summary: Get a links library item by ID
      description: Returns the complete state of a links library item by ID.
      operationId: get-links-id
      parameters:
        - name: id
          in: path
          description: 'The unique ID of the links library item, as returned by the create or search endpoints.'
          required: true
          schema:
            maxLength: 250
            type: string
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    required:
                      - links
                      - title
                    type: object
                    properties:
                      description:
                        type: string
                      layout:
                        enum:
                          - horizontal
                          - vertical
                        type: string
                        description: Whether to display the links in a horizontal or vertical layout.
                      links:
                        maxItems: 100
                        type: array
                        items:
                          oneOf:
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                          discriminator:
                            propertyName: type
                            mapping:
                              dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                              externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                        description: The list of links to display.
                      tags:
                        maxItems: 1000
                        type: array
                        items:
                          maxLength: 250
                          type: string
                        description: Tag IDs associated with this library item.
                        default: [ ]
                      title:
                        type: string
                    additionalProperties: false
                  id:
                    maxLength: 250
                    type: string
                    description: 'The unique ID of the links library item, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                getLinksResponse:
                  summary: Get links library item response
                  description: 'The full links library item state including `links`, `layout`, `title`, `description`, and metadata.'
                  value:
                    data:
                      description: A collection of important links
                      layout: horizontal
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
        '403':
          description: forbidden
        '404':
          description: A links library item with the given ID was not found.
      x-codeSamples:
        - label: Get a links library item - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Get a links library item - Console
          lang: Console
          source: "GET kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Links
      summary: Upsert links library item
      description: "Replaces the full state of a links library item. Partial updates are not supported.\nTo make incremental changes, retrieve the item first, modify the fields you need, then send the complete object back.\n\nIf no item exists with the specified ID, a new one is created."
      operationId: put-links-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The unique ID of the links library item to be created or updated
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - links
                - title
              type: object
              properties:
                description:
                  type: string
                layout:
                  enum:
                    - horizontal
                    - vertical
                  type: string
                  description: Whether to display the links in a horizontal or vertical layout.
                links:
                  maxItems: 100
                  type: array
                  items:
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                    discriminator:
                      propertyName: type
                      mapping:
                        dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                        externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                  description: The list of links to display.
                tags:
                  maxItems: 1000
                  type: array
                  items:
                    maxLength: 250
                    type: string
                  description: Tag IDs associated with this library item.
                  default: [ ]
                title:
                  type: string
              additionalProperties: false
            examples:
              upsertLinks:
                summary: Upsert a links library item
                value:
                  description: A collection of important links
                  layout: vertical
                  links:
                    - destination: dashboard-abc-123
                      label: Overview
                      options:
                        open_in_new_tab: false
                        use_filters: true
                        use_time_range: true
                      type: dashboardLink
                    - destination: https://www.elastic.co/docs
                      label: Elastic Documentation
                      options:
                        encode_url: true
                        open_in_new_tab: true
                      type: externalLink
                  title: Important Resources
      responses:
        '200':
          description: updated
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_LinksItemResponse'
              examples:
                upsertLinks:
                  summary: Update links library item response
                  description: 'The complete updated links library item state after a full replacement. PUT replaces the entire item, so any fields omitted from the request are reset to their defaults.'
                  value:
                    data:
                      description: A collection of important links
                      layout: vertical
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzYwLDFd
        '201':
          description: created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_LinksItemResponse'
              examples:
                createdLinks:
                  summary: Create links library item response (via upsert)
                  description: Returned when the upsert created a new item because no item existed with the specified ID.
                  value:
                    data:
                      description: A collection of important links
                      layout: horizontal
                      links:
                        - destination: dashboard-abc-123
                          label: Overview
                          options:
                            open_in_new_tab: false
                            use_filters: true
                            use_time_range: true
                          type: dashboardLink
                        - destination: https://www.elastic.co/docs
                          label: Elastic Documentation
                          options:
                            encode_url: true
                            open_in_new_tab: true
                          type: externalLink
                      title: Important Resources
                    id: 0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
        '400':
          description: invalid request
        '403':
          description: forbidden
        '409':
          description: conflict
      x-codeSamples:
        - label: Upsert a links library item - cURL
          lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Important Resources\",\n  \"description\": \"A collection of important links\",\n  \"links\": [\n    {\n      \"label\": \"Overview\",\n      \"type\": \"dashboardLink\",\n      \"destination\": \"dashboard-abc-123\",\n      \"options\": {\n        \"open_in_new_tab\": false,\n        \"use_time_range\": true,\n        \"use_filters\": true\n      }\n    },\n    {\n      \"label\": \"Elastic Documentation\",\n      \"type\": \"externalLink\",\n      \"destination\": \"https://www.elastic.co/docs\",\n      \"options\": {\n        \"encode_url\": true,\n        \"open_in_new_tab\": true\n      }\n    }\n  ],\n  \"layout\": \"vertical\"\n}'"
        - label: Upsert a links library item - Console
          lang: Console
          source: "PUT kbn:/api/links/0ee9d0ea-06a0-4a30-bf4e-be4d3ca85bf3\n{\n  \"title\": \"Important Resources\",\n  \"description\": \"A collection of important links\",\n  \"links\": [\n    {\n      \"label\": \"Overview\",\n      \"type\": \"dashboardLink\",\n      \"destination\": \"dashboard-abc-123\",\n      \"options\": {\n        \"open_in_new_tab\": false,\n        \"use_time_range\": true,\n        \"use_filters\": true\n      }\n    },\n    {\n      \"label\": \"Elastic Documentation\",\n      \"type\": \"externalLink\",\n      \"destination\": \"https://www.elastic.co/docs\",\n      \"options\": {\n        \"encode_url\": true,\n        \"open_in_new_tab\": true\n      }\n    }\n  ],\n  \"layout\": \"vertical\"\n}\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists:
    delete:
      tags:
        - Security Lists API
      summary: Delete a value list
      description: "Delete a value list using the list ID.\n> info\n> When you delete a list, all of its list items are also deleted.\n"
      operationId: DeleteList
      parameters:
        - name: id
          in: query
          description: 'Value list identifier to delete, including all of its list items.'
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - name: deleteReferences
          in: query
          description: Determines whether exception items referencing this value list should be deleted.
          schema:
            type: boolean
            default: false
            example: false
        - name: ignoreReferences
          in: query
          description: Determines whether to delete value list without performing any additional checks of where this list may be utilized.
          schema:
            type: boolean
            default: false
            example: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
              examples:
                ipList:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: List of bad internet ips.
                    id: 21b01cfb-058d-44b9-838c-282be16c91cd
                    immutable: false
                    name: Bad ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:39:39.292Z'
                    updated_by: elastic
                    version: 3
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: id: Required'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [DELETE /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: List not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list id: \"ip_list\" was not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Lists API
      summary: Get value list details
      description: Get the details of a value list using the list ID.
      operationId: ReadList
      parameters:
        - name: id
          in: query
          description: Value list identifier (`id`) returned when the list was created.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
              examples:
                ip:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ip
                    id: ip_list
                    immutable: false
                    name: My bad ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:21:53.843Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: id: Required'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]"
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/lists?id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: List not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - Security Lists API
      summary: Patch a value list
      description: Update specific fields of an existing list using the list `id`.
      operationId: PatchList
      requestBody:
        description: Value list's properties
        content:
          application/json:
            schema:
              required:
                - id
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersion'
              example:
                id: ip_list
                name: Bad ips list - UPDATED
            examples:
              patchName:
                value:
                  id: ip_list
                  name: Bad ips list - UPDATED
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
              examples:
                ip:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ips
                    id: ip_list
                    immutable: false
                    name: Bad ips list - UPDATED
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:21:53.843Z'
                    updated_by: elastic
                    version: 2
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: name: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PATCH /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: List not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Lists API
      summary: Create a value list
      description: Create a new value list.
      operationId: CreateList
      requestBody:
        description: Value list's properties
        content:
          application/json:
            schema:
              required:
                - name
                - description
                - type
              type: object
              properties:
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                type:
                  $ref: '#/components/schemas/Security_Lists_API_ListType'
                version:
                  minimum: 1
                  type: integer
                  default: 1
            examples:
              ip:
                value:
                  description: This list describes bad internet ips
                  id: ip_list
                  name: Simple list with ips
                  type: ip
              ip_range:
                value:
                  description: This list has ip ranges
                  id: ip_range_list
                  name: Simple list with ip ranges
                  type: ip_range
              keyword:
                value:
                  description: This list describes bad host names
                  id: keyword_list
                  name: Simple list with a keyword
                  type: keyword
              keyword_custom_format:
                value:
                  description: This parses the first found ipv4 only
                  id: keyword_custom_format_list
                  name: Simple list with a keyword using a custom format
                  type: keyword
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ips
                    id: ip_list
                    immutable: false
                    name: Simple list with ips
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T04:47:34.273Z'
                    updated_by: elastic
                    version: 1
                ip_range:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-09T18:23:52.241Z'
                    created_at: '2025-01-09T18:23:52.241Z'
                    created_by: elastic
                    description: This list has ip ranges
                    id: ip_range_list
                    immutable: false
                    name: Simple list with ip ranges
                    tie_breaker_id: 74aebdaf-601f-4940-b351-155728ff7003
                    type: ip_range
                    updated_at: '2025-01-09T18:23:52.241Z'
                    updated_by: elastic
                    version: 1
                keyword:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-09T18:24:55.786Z'
                    created_at: '2025-01-09T18:24:55.786Z'
                    created_by: elastic
                    description: This list describes bad host names
                    id: keyword_list
                    immutable: false
                    name: Simple list with a keyword
                    tie_breaker_id: f7e7dbaa-daf7-4c9a-a3dc-56643923ef68
                    type: keyword
                    updated_at: '2025-01-09T18:24:55.786Z'
                    updated_by: elastic
                    version: 1
                keyword_custom_format:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-09T18:25:39.604Z'
                    created_at: '2025-01-09T18:25:39.604Z'
                    created_by: elastic
                    description: This parses the first found ipv4 only
                    id: keyword_custom_format_list
                    immutable: false
                    name: Simple list with a keyword using a custom format
                    tie_breaker_id: 8247ae63-b780-47b8-9a89-948b643e9ec2
                    type: keyword
                    updated_at: '2025-01-09T18:25:39.604Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'To create a list, the data stream must exist first. Data stream \".lists-default\" does not exist'
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '409':
          description: List already exists response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'list id: "keyword_custom_format_list" already exists'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Lists API
      summary: Update a value list
      description: "Update a value list using the list `id`. The original list is replaced, and all unspecified fields are deleted.\n> info\n> You cannot modify the `id` value.\n"
      operationId: UpdateList
      requestBody:
        description: Value list's properties
        content:
          application/json:
            schema:
              required:
                - id
                - name
                - description
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                description:
                  $ref: '#/components/schemas/Security_Lists_API_ListDescription'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
                name:
                  $ref: '#/components/schemas/Security_Lists_API_ListName'
                version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersion'
              example:
                description: Latest list of bad ips
                id: ip_list
                name: Bad ips - updated
            examples:
              replaceList:
                value:
                  description: Latest list of bad ips
                  id: ip_list
                  name: Bad ips - updated
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
              examples:
                ip:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: Latest list of bad ips
                    id: ip_list
                    immutable: false
                    name: Bad ips - updated
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T05:39:39.292Z'
                    updated_by: elastic
                    version: 3
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: id: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PUT /api/lists] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: List not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list id: \"foo\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/_find:
    get:
      tags:
        - Security Lists API
      summary: Get value lists
      description: 'Get a paginated subset of value lists. By default, the first page is returned, with 20 results per page.'
      operationId: FindLists
      parameters:
        - name: page
          in: query
          description: The page number to return.
          schema:
            type: integer
            example: 1
        - name: per_page
          in: query
          description: The number of value lists to return per page.
          schema:
            type: integer
            example: 20
        - name: sort_field
          in: query
          description: Determines which field is used to sort the results.
          schema:
            minLength: 1
            type: string
            format: nonempty
            example: name
        - name: sort_order
          in: query
          description: 'Determines the sort order, which can be `desc` or `asc`'
          schema:
            enum:
              - desc
              - asc
            type: string
            example: asc
        - name: cursor
          in: query
          description: Returns the lists that come after the last lists returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all lists are sorted and returned correctly.
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListsCursor'
        - name: filter
          in: query
          description: "Filters the returned results according to the value of the specified field,\nusing the <field name>:<field value> syntax.\n"
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListsFilter'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - data
                  - page
                  - per_page
                  - total
                  - cursor
                type: object
                properties:
                  cursor:
                    $ref: '#/components/schemas/Security_Lists_API_FindListsCursor'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_List'
                  page:
                    minimum: 0
                    type: integer
                  per_page:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
              examples:
                ipList:
                  value:
                    cursor: WzIwLFsiZjU1MDgxODgtYjFlOS00ZTZlLTk2NjItZDAzOWE3ZDg5ODk5Il1d
                    data:
                      - _version: WzAsMV0=
                        '@timestamp': "2025-01-08T04:47:34.273Z\n"
                        created_at: "2025-01-08T04:47:34.273Z\n"
                        created_by: elastic
                        description: This list describes bad internet ip
                        id: ip_list
                        immutable: false
                        name: Simple list with an ip
                        tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                        type: ip
                        updated_at: "2025-01-08T04:47:34.273Z\n"
                        updated_by: elastic
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request query]: page: Expected number, received nan'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/lists/_find?page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/index:
    delete:
      tags:
        - Security Lists API
      summary: Delete value list data streams
      description: Delete the `.lists` and `.items` data streams.
      operationId: DeleteListIndex
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - acknowledged
                type: object
                properties:
                  acknowledged:
                    type: boolean
              examples:
                acknowledged:
                  value:
                    acknowledged: true
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: 'Unable to delete value list data streams: invalid or missing index metadata'
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [DELETE /api/lists/index] is not authorized; lists-all (or equivalent) is required to delete data streams'
                    statusCode: 403
        '404':
          description: List data stream not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: The value list data stream was not found in this space
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Lists API
      summary: Get status of value list data streams
      description: Verify that `.lists` and `.items` data streams exist.
      operationId: ReadListIndex
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - list_index
                  - list_item_index
                type: object
                properties:
                  list_index:
                    type: boolean
                  list_item_index:
                    type: boolean
              examples:
                bothExist:
                  value:
                    list_index: true
                    list_item_index: true
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: Unable to read value list data stream status for this space
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/lists/index] is not authorized; list read permissions are required'
                    statusCode: 403
        '404':
          description: List data stream(s) not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: Value list backing indices were not found for this space
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Lists API
      summary: Create list data streams
      description: "**DEPRECATED.** `deprecated: true` is set on this operation. Value list backing data streams for the space\nare now created as part of supported workflows; calling this explicitly is rarely required.\n**WARNING:** Do not use for new integrations. Prefer the UI or the list and list-item APIs after confirming\nindices exist with `GET /api/lists/index`.\n\nCreates the `.lists` and `.items` data streams in the current Kibana space.\n"
      operationId: CreateListIndex
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - acknowledged
                type: object
                properties:
                  acknowledged:
                    type: boolean
              examples:
                acknowledged:
                  value:
                    acknowledged: true
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: Indices exist but the request could not be completed for the current space. Check that Elasticsearch and Kibana privileges allow index creation for lists.
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: "[security_exception\\n\\tRoot causes:\\n\\t\\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]\n"
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/lists/index] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '409':
          description: List data stream exists response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'data stream: \".lists-default\" and \".items-default\" already exists'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      deprecated: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items:
    delete:
      tags:
        - Security Lists API
      summary: Delete a value list item
      description: 'Delete a value list item using its `id`, or its `list_id` and `value` fields.'
      operationId: DeleteListItem
      parameters:
        - name: id
          in: query
          description: Value list item's identifier. Required if `list_id` and `value` are not specified.
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListItemId'
        - name: list_id
          in: query
          description: Value list's identifier. Required if `id` is not specified.
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - name: value
          in: query
          description: The value used to evaluate exceptions. Required if `id` is not specified.
          schema:
            type: string
            example: 255.255.255.255
        - name: refresh
          in: query
          description: Determines when changes made by the request are made visible to search.
          schema:
            enum:
              - 'true'
              - 'false'
              - wait_for
            type: string
            default: 'false'
            example: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  - type: array
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
              examples:
                ip:
                  value:
                    _version: WzIwLDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:44:14.009Z'
                    updated_by: elastic
                    value: 255.255.255.255
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: Either \"list_id\" or \"id\" needs to be defined in the request
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [DELETE /api/lists/items?id=pd1WRJQBs4HAK3VQeHFI] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: List item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list item with id: \"pd1WRJQBs4HAK3VQeHFI\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Lists API
      summary: Get a value list item
      description: Get the details of a value list item.
      operationId: ReadListItem
      parameters:
        - name: id
          in: query
          description: Value list item identifier. Required if `list_id` and `value` are not specified.
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - name: list_id
          in: query
          description: Value list item list's `id` identfier. Required if `id` is not specified.
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - name: value
          in: query
          description: The value used to evaluate exceptions. Required if `id` is not specified.
          schema:
            type: string
            example: 127.0.0.2
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  - type: array
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
              examples:
                ip:
                  value:
                    _version: WzExLDFd
                    '@timestamp': '2025-01-08T05:16:25.882Z'
                    created_at: '2025-01-08T05:16:25.882Z'
                    created_by: elastic
                    id: qN1XRJQBs4HAK3VQs3Gc
                    list_id: ip_list
                    tie_breaker_id: a9a34c02-a385-436e-86a0-02a3942f3537
                    type: ip
                    updated_at: '2025-01-08T05:16:25.882Z'
                    updated_by: elastic
                    value: 127.0.0.2
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: Either \"list_id\" or \"id\" needs to be defined in the request
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/lists/items?id=qN1XRJQBs4HAK3VQs3Gc] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: List item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - Security Lists API
      summary: Patch a value list item
      description: Update specific fields of an existing value list item using the item `id`.
      operationId: PatchListItem
      requestBody:
        description: Value list item's properties
        content:
          application/json:
            schema:
              required:
                - id
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                refresh:
                  enum:
                    - 'true'
                    - 'false'
                    - wait_for
                  type: string
                  description: Determines when changes made by the request are made visible to search.
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
            examples:
              changeValue:
                value:
                  id: pd1WRJQBs4HAK3VQeHFI
                  value: 255.255.255.255
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
              examples:
                ipItem:
                  value:
                    _version: WzE5LDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:23:37.602Z'
                    updated_by: elastic
                    value: 255.255.255.255
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: '{"took":15,"timed_out":false,"total":1,"updated":0,"deleted":0,"batches":1,"version_conflicts":0,"noops":0,"retries":{"bulk":0,"search":0},"throttled_millis":0,"requests_per_second":-1,"throttled_until_millis":0,"failures":[{"index":".ds-.items-default-2025.01.09-000001","id":"ip_item","cause":{"type":"document_parsing_exception","reason":"[1:107] failed to parse field [ip] of type [ip] in document with id ip_item. Preview of fields value: 2","caused_by":{"type":"illegal_argument_exception","reason":"2 is not an IP string literal."}},"status":400}]}'
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: List item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Lists API
      summary: Create a value list item
      description: "Create a value list item and associate it with the specified value list.\n\nAll value list items in the same list must be the same type. For example, each list item in an `ip` list must define a specific IP address.\n> info\n> Before creating a list item, you must create a list.\n"
      operationId: CreateListItem
      requestBody:
        description: Value list item's properties
        content:
          application/json:
            schema:
              required:
                - list_id
                - value
              type: object
              properties:
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                list_id:
                  $ref: '#/components/schemas/Security_Lists_API_ListId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                refresh:
                  enum:
                    - 'true'
                    - 'false'
                    - wait_for
                  type: string
                  description: Determines when changes made by the request are made visible to search.
                  example: wait_for
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
            examples:
              ip:
                value:
                  list_id: ip_list
                  value: 127.0.0.1
              ip_range:
                value:
                  list_id: ip_range_list
                  value: 192.168.0.0/16
              keyword:
                value:
                  list_id: keyword_list
                  value: zeek
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:59:06.154Z'
                    created_at: '2025-01-08T04:59:06.154Z'
                    created_by: elastic
                    id: 21b01cfb-058d-44b9-838c-282be16c91cc
                    list_id: ip_list
                    tie_breaker_id: b57c762c-3036-465c-9bfb-7bfb5e6e515a
                    type: ip
                    updated_at: '2025-01-08T04:59:06.154Z'
                    updated_by: elastic
                    value: 127.0.0.1
                ip_range:
                  value:
                    _version: WzEsMV0=
                    '@timestamp': '2025-01-09T18:33:08.202Z'
                    created_at: '2025-01-09T18:33:08.202Z'
                    created_by: elastic
                    id: ip_range_item
                    list_id: ip_range_list
                    tie_breaker_id: ea1b4189-efda-4637-b8f9-74655a5ebb61
                    type: ip_range
                    updated_at: '2025-01-09T18:33:08.202Z'
                    updated_by: elastic
                    value: 192.168.0.0/16
                keyword:
                  value:
                    _version: WzIsMV0=
                    '@timestamp': '2025-01-09T18:34:29.422Z'
                    created_at: '2025-01-09T18:34:29.422Z'
                    created_by: elastic
                    id: 7f24737d-1da8-4626-a568-33070591bb4e
                    list_id: keyword_list
                    tie_breaker_id: 2108ced2-5e5d-401e-a88e-4dd69fc5fa27
                    type: keyword
                    updated_at: '2025-01-09T18:34:29.422Z'
                    updated_by: elastic
                    value: zeek
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'uri [/api/lists/items] with method [post] exists but is not available with the current configuration'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                listNotFound:
                  value:
                    message: 'list id: \"ip_list\" does not exist'
                    status_code: 404
        '409':
          description: List item already exists response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                alreadyExists:
                  value:
                    message: 'list item id: \"ip_item\" already exists'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Lists API
      summary: Update a value list item
      description: "Update a value list item using the list item ID. The original list item is replaced, and all unspecified fields are deleted.\n> info\n> You cannot modify the `id` value.\n"
      operationId: UpdateListItem
      requestBody:
        description: Value list item's properties
        content:
          application/json:
            schema:
              required:
                - id
                - value
              type: object
              properties:
                _version:
                  $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
                id:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemId'
                meta:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
                value:
                  $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
              example:
                id: ip_item
                value: 255.255.255.255
            examples:
              fullReplace:
                value:
                  id: ip_item
                  value: 255.255.255.255
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_ListItem'
              examples:
                ip:
                  value:
                    _version: WzIwLDFd
                    '@timestamp': '2025-01-08T05:15:05.159Z'
                    created_at: '2025-01-08T05:15:05.159Z'
                    created_by: elastic
                    id: pd1WRJQBs4HAK3VQeHFI
                    list_id: ip_list
                    tie_breaker_id: eee41dc7-1666-4876-982f-8b0f7b59eca3
                    type: ip
                    updated_at: '2025-01-08T05:44:14.009Z'
                    updated_by: elastic
                    value: 255.255.255.255
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: '[request body]: id: Expected string, received number'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [PATCH /api/lists/items] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '404':
          description: List item not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list item id: \"foo\" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items/_export:
    post:
      tags:
        - Security Lists API
      summary: Export value list items
      description: Export list item values from the specified value list.
      operationId: ExportListItems
      parameters:
        - name: list_id
          in: query
          description: Value list's `id` to export.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
      responses:
        '200':
          description: Successful response
          content:
            application/ndjson:
              schema:
                type: string
                description: A `.txt` file containing list items from the specified list
                format: binary
                example: "127.0.0.1\n127.0.0.2\n127.0.0.3\n127.0.0.4\n127.0.0.5\n127.0.0.6\n127.0.0.7\n127.0.0.8\n127.0.0.9\n"
              examples:
                ipLines:
                  value: "127.0.0.1\n127.0.0.2\n127.0.0.3\n"
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: 'Bad Request","message":"[request query]: list_id: Required'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/lists/items/_export?list_id=ips.txt] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '404':
          description: List not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                notFound:
                  value:
                    message: 'list id: "unknown_list" not found'
                    status_code: 404
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items/_find:
    get:
      tags:
        - Security Lists API
      summary: Get value list items
      description: Get all value list items in the specified list.
      operationId: FindListItems
      parameters:
        - name: list_id
          in: query
          description: Parent value list's `id` to page through items for.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - name: page
          in: query
          description: The page number to return.
          schema:
            type: integer
            example: 1
        - name: per_page
          in: query
          description: The number of list items to return per page.
          schema:
            type: integer
            example: 20
        - name: sort_field
          in: query
          description: Determines which field is used to sort the results.
          schema:
            minLength: 1
            type: string
            format: nonempty
            example: value
        - name: sort_order
          in: query
          description: 'Determines the sort order, which can be `desc` or `asc`'
          schema:
            enum:
              - desc
              - asc
            type: string
            example: asc
        - name: cursor
          in: query
          description: "Opaque cursor returned in a previous response; pass it to continue listing from the next page. Omit on the first request.\n"
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListItemsCursor'
        - name: filter
          in: query
          description: "Filters the returned results according to the value of the specified field,\nusing the <field name>:<field value> syntax.\n"
          schema:
            $ref: '#/components/schemas/Security_Lists_API_FindListItemsFilter'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - data
                  - page
                  - per_page
                  - total
                  - cursor
                type: object
                properties:
                  cursor:
                    $ref: '#/components/schemas/Security_Lists_API_FindListItemsCursor'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Lists_API_ListItem'
                  page:
                    minimum: 0
                    type: integer
                  per_page:
                    minimum: 0
                    type: integer
                  total:
                    minimum: 0
                    type: integer
              examples:
                ip:
                  value:
                    cursor: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
                    data:
                      - _version: WzAsMV0=
                        '@timestamp': '2025-01-08T04:59:06.154Z'
                        created_at: '2025-01-08T04:59:06.154Z'
                        created_by: elastic
                        id: 21b01cfb-058d-44b9-838c-282be16c91cc
                        list_id: ip_list
                        tie_breaker_id: b57c762c-3036-465c-9bfb-7bfb5e6e515a
                        type: ip
                        updated_at: '2025-01-08T04:59:06.154Z'
                        updated_by: elastic
                        value: 127.0.0.1
                    page: 1
                    per_page: 20
                    total: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: 'Bad Request,'
                    message: '[request query]: list_id: Required'
                    statusCode: '400,'
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/lists/items/_find?list_id=ip_list&page=1&per_page=20] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/items/_import:
    post:
      tags:
        - Security Lists API
      summary: Import value list items
      description: "Import value list items from a TXT or CSV file. The maximum file size is 9 million bytes.\n\nYou can import items to a new or existing list.\n"
      operationId: ImportListItems
      parameters:
        - name: list_id
          in: query
          description: "List's id.\n\nRequired when importing to an existing list.\n"
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListId'
        - name: type
          in: query
          description: "Type of the importing list.\n\nRequired when importing a new list whose list `id` is not specified.\n"
          schema:
            $ref: '#/components/schemas/Security_Lists_API_ListType'
          examples:
            ip:
              value: ip
        - name: refresh
          in: query
          description: Determines when changes made by the request are made visible to search.
          schema:
            enum:
              - 'true'
              - 'false'
              - wait_for
            type: string
            example: true
      requestBody:
        content:
          multipart/form-data:
            schema:
              type: object
              properties:
                file:
                  type: string
                  description: A `.txt` or `.csv` file containing newline separated list items.
                  format: binary
                  example: "127.0.0.1\n127.0.0.2\n127.0.0.3\n127.0.0.4\n127.0.0.5\n127.0.0.6\n127.0.0.7\n127.0.0.8\n127.0.0.9\n"
            examples:
              ipLinesFile:
                value:
                  file: list_values.txt
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_List'
              examples:
                ip:
                  value:
                    _version: WzAsMV0=
                    '@timestamp': '2025-01-08T04:47:34.273Z'
                    created_at: '2025-01-08T04:47:34.273Z'
                    created_by: elastic
                    description: This list describes bad internet ip
                    id: ip_list
                    immutable: false
                    name: Simple list with an ip
                    tie_breaker_id: f5508188-b1e9-4e6e-9662-d039a7d89899
                    type: ip
                    updated_at: '2025-01-08T04:47:34.273Z'
                    updated_by: elastic
                    version: 1
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    message: Either type or list_id need to be defined in the query
                    status_code: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [POST /api/lists/items/_import?list_id=ip_list] is unauthorized for user, this action is granted by the Kibana privileges [lists-all]'
                    statusCode: 403
        '409':
          description: List with specified list_id does not exist response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                conflict:
                  value:
                    message: 'List with the specified list_id does not exist, create the list or fix list_id to import to an existing one'
                    status_code: 409
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/lists/privileges:
    get:
      tags:
        - Security Lists API
      summary: Get value list privileges
      description: "Returns the caller's authentication state and the Elasticsearch `cluster`, `index`, and `application`\nprivileges for `.lists` and `.items` data streams in the current Kibana space. Use this to decide which list\nAPIs (`read` vs `all` operations) are available before you create or import lists.\n"
      operationId: ReadListPrivileges
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                required:
                  - lists
                  - listItems
                  - is_authenticated
                type: object
                properties:
                  is_authenticated:
                    type: boolean
                  listItems:
                    $ref: '#/components/schemas/Security_Lists_API_ListItemPrivileges'
                  lists:
                    $ref: '#/components/schemas/Security_Lists_API_ListPrivileges'
              examples:
                privileges:
                  value:
                    is_authenticated: true
                    listItems:
                      application: { }
                      cluster:
                        all: true
                        manage: true
                        manage_api_key: true
                        manage_index_templates: true
                        manage_ml: true
                        manage_own_api_key: true
                        manage_pipeline: true
                        manage_security: true
                        manage_transform: true
                        monitor: true
                        monitor_ml: true
                        monitor_transform: true
                      has_all_requested: true
                      index:
                        .items-default:
                          all: true
                          create: true
                          create_doc: true
                          create_index: true
                          delete: true
                          delete_index: true
                          index: true
                          maintenance: true
                          manage: true
                          monitor: true
                          read: true
                          view_index_metadata: true
                          write: true
                      username: elastic
                    lists:
                      application: { }
                      cluster:
                        all: true
                        manage: true
                        manage_api_key: true
                        manage_index_templates: true
                        manage_ml: true
                        manage_own_api_key: true
                        manage_pipeline: true
                        manage_security: true
                        manage_transform: true
                        monitor: true
                        monitor_ml: true
                        monitor_transform: true
                      has_all_requested: true
                      index:
                        .lists-default:
                          all: true
                          create: true
                          create_doc: true
                          create_index: true
                          delete: true
                          delete_index: true
                          index: true
                          maintenance: true
                          manage: true
                          monitor: true
                          read: true
                          view_index_metadata: true
                          write: true
                      username: elastic
        '400':
          description: Invalid input data response
          content:
            application/json:
              schema:
                oneOf:
                  - $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
                  - $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                badRequest:
                  value:
                    error: Bad Request
                    message: 'Unable to resolve list privileges: invalid or missing space context for this request'
                    statusCode: 400
        '401':
          description: Unsuccessful authentication response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                unauthorized:
                  value:
                    error: Unauthorized
                    message: '[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastic] for REST request [/_security/_authenticate]]: unable to authenticate user [elastic] for REST request [/_security/_authenticate]'
                    statusCode: 401
        '403':
          description: Not enough privileges response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_PlatformErrorResponse'
              examples:
                forbidden:
                  value:
                    error: Forbidden
                    message: 'API [GET /api/lists/privileges] is unauthorized for user, this action is granted by the Kibana privileges [lists-read]'
                    statusCode: 403
        '500':
          description: Internal server error response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Lists_API_SiemErrorResponse'
              examples:
                serverError:
                  value:
                    message: Internal Server Error
                    status_code: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/logstash/pipeline/{id}':
    delete:
      tags:
        - logstash
      summary: Delete a Logstash pipeline
      description: "Delete a centrally-managed Logstash pipeline.\nIf your Elasticsearch cluster is protected with basic authentication, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.\n"
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: delete-logstash-pipeline
      parameters:
        - name: id
          in: path
          description: An identifier for the pipeline.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - logstash
      summary: Get a Logstash pipeline
      description: "Get information for a centrally-managed Logstash pipeline.\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.\n"
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: get-logstash-pipeline
      parameters:
        - name: id
          in: path
          description: An identifier for the pipeline.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                type: object
              examples:
                getLogstashPipelineResponseExample1:
                  value: "{\n  \"id\": \"hello-world\",\n  \"description\": \"Just a simple pipeline\",\n  \"username\": \"elastic\",\n  \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n  \"settings\": {\n    \"queue.type\": \"persistent\"\n  }\n}"
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - logstash
      summary: Create or update a Logstash pipeline
      description: "Create a centrally-managed Logstash pipeline or update a pipeline.\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash writer role.\n"
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: put-logstash-pipeline
      parameters:
        - name: id
          in: path
          description: "An identifier for the pipeline. Pipeline ID must begin with a letter or underscore and can contain only letters, underscores, dashes, hyphens, and numbers.\n"
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - pipeline
              type: object
              properties:
                description:
                  maxLength: 1024
                  type: string
                  description: A description of the pipeline.
                pipeline:
                  type: string
                  description: A definition for the pipeline.
                settings:
                  type: object
                  description: "Supported settings, represented as object keys, include the following:\n\n- `pipeline.workers`\n- `pipeline.batch.size`\n- `pipeline.batch.delay`\n- `pipeline.ecs_compatibility`\n- `pipeline.ordered`\n- `queue.type`\n- `queue.max_bytes`\n- `queue.checkpoint.writes`\n"
            examples:
              putLogstashPipelineRequestExample1:
                value: "{\n  \"pipeline\": \"input { stdin {} } output { stdout {} }\",\n  \"settings\": {\n    \"queue.type\": \"persisted\"\n  }\n}"
      responses:
        '204':
          description: Indicates a successful call
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/logstash/pipelines:
    get:
      tags:
        - logstash
      summary: Get all Logstash pipelines
      description: "Get a list of all centrally-managed Logstash pipelines.\n\nTo use this API, you must have either the `logstash_admin` built-in role or a customized Logstash reader role.\n> info\n> Limit the number of pipelines to 10,000 or fewer. As the number of pipelines nears and surpasses 10,000, you may see performance issues on Kibana.\n\nThe `username` property appears in the response when security is enabled and depends on when the pipeline was created or last updated.\n"
      externalDocs:
        description: Secure your connection
        url: https://www.elastic.co/docs/reference/logstash/secure-connection
      operationId: get-logstash-pipelines
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                type: object
              examples:
                getLogstashPipelinesResponseExample1:
                  value: "{\n  \"pipelines\": [\n    {\n      \"id\": \"hello-world\",\n      \"description\": \"Just a simple pipeline\",\n      \"last_modified\": \"2018-04-14T12:23:29.772Z\",\n      \"username\": \"elastic\" \n    },\n    {\n      \"id\": \"sleepy-pipeline\",\n      \"description\": \"\",\n      \"last_modified\": \"2018-03-24T03:41:30.554Z\"\n    }\n  ]\n}"
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window:
    post:
      tags:
        - maintenance-window
      summary: Create a maintenance window.
      description: '[Required authorization] Route required privileges: write-maintenance-window.'
      operationId: post-maintenance-window
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_new_maintenance_window'
            examples:
              createMaintenanceWindowRequest:
                summary: Create a maintenance window
                description: "Create a maintenance window that recurs every week on Monday and Wednesday for two hours, with a scope that filters specific alerts using a KQL query.\n"
                value:
                  enabled: true
                  schedule:
                    custom:
                      duration: 2h
                      recurring:
                        every: 1w
                        occurrences: 10
                        onWeekDay:
                          - MO
                          - WE
                      start: '2025-03-01T08:00:00.000Z'
                      timezone: Europe/Amsterdam
                  scope:
                    alerting:
                      query:
                        kql: 'kibana.alert.tags: "infra"'
                  title: Weekly Maintenance Window
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
              examples:
                createMaintenanceWindowResponse:
                  summary: Create a maintenance window response
                  description: "The response returned when a maintenance window is successfully created.\n"
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: upcoming
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/maintenance_window/_find:
    get:
      tags:
        - maintenance-window
      summary: Search for a maintenance window.
      description: '[Required authorization] Route required privileges: read-maintenance-window.'
      operationId: get-maintenance-window-find
      parameters:
        - name: title
          in: query
          description: The title of the maintenance window.
          schema:
            type: string
        - name: created_by
          in: query
          description: The user who created the maintenance window.
          schema:
            type: string
        - name: status
          in: query
          description: 'The status of the maintenance window. It can be "running", "upcoming", "finished", "archived", or "disabled".'
          schema:
            type: array
            items:
              enum:
                - running
                - finished
                - upcoming
                - archived
                - disabled
              type: string
        - name: page
          in: query
          description: The page number to return.
          schema:
            maximum: 100
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of maintenance windows to return per page.
          schema:
            maximum: 100
            minimum: 1
            type: number
            default: 10
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_find_maintenance_windows_response'
              examples:
                findMaintenanceWindowsResponse:
                  summary: Find maintenance windows response
                  description: "The response returned when maintenance windows are successfully found.\n"
                  value:
                    maintenanceWindows:
                      - created_at: '2025-02-25T10:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        id: f0cb1780-537a-4e34-8adf-3b4336862858
                        schedule:
                          custom:
                            duration: 2h
                            recurring:
                              every: 1w
                              occurrences: 10
                              onWeekDay:
                                - MO
                                - WE
                            start: '2025-03-01T08:00:00.000Z'
                            timezone: Europe/Amsterdam
                        scope:
                          alerting:
                            query:
                              kql: 'kibana.alert.tags: "infra"'
                        status: upcoming
                        title: Weekly Maintenance Window
                        updated_at: '2025-02-25T10:00:00.000Z'
                        updated_by: elastic
                      - created_at: '2025-03-10T09:00:00.000Z'
                        created_by: elastic
                        enabled: true
                        id: a1c94560-6e3b-4ea1-9065-8e3f1b8c5f29
                        schedule:
                          custom:
                            duration: 1h
                            recurring:
                              end: '2025-12-31T00:00:00.000Z'
                              every: 2w
                              onWeekDay:
                                - FR
                            start: '2025-04-01T10:00:00.000Z'
                            timezone: US/Eastern
                        scope:
                          alerting:
                            query:
                              kql: 'kibana.alert.tags: "database"'
                        status: upcoming
                        title: Database Upgrade Window
                        updated_at: '2025-03-15T14:30:00.000Z'
                        updated_by: elastic
                    page: 1
                    per_page: 10
                    total: 2
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
      x-state: Generally available; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/maintenance_window/{id}':
    delete:
      tags:
        - maintenance-window
      summary: Delete a maintenance window.
      description: '[Required authorization] Route required privileges: write-maintenance-window.'
      operationId: delete-maintenance-window-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the maintenance window to be deleted.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - maintenance-window
      summary: Get maintenance window details.
      description: '[Required authorization] Route required privileges: read-maintenance-window.'
      operationId: get-maintenance-window-id
      parameters:
        - name: id
          in: path
          description: The identifier for the maintenance window.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
              examples:
                getMaintenanceWindowResponse:
                  summary: Get a maintenance window response
                  description: "The response returned when a maintenance window is successfully retrieved.\n"
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: upcoming
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - maintenance-window
      summary: Update a maintenance window.
      description: '[Required authorization] Route required privileges: write-maintenance-window.'
      operationId: patch-maintenance-window-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the maintenance window.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_update_maintenance_window'
            examples:
              updateMaintenanceWindowRequest:
                summary: Update a maintenance window
                description: "Update a maintenance window to change its title, schedule, and scope.\n"
                value:
                  enabled: true
                  schedule:
                    custom:
                      duration: 1h
                      recurring:
                        end: '2025-12-31T00:00:00.000Z'
                        every: 2w
                        onWeekDay:
                          - FR
                      start: '2025-04-01T10:00:00.000Z'
                      timezone: US/Eastern
                  scope:
                    alerting:
                      query:
                        kql: 'kibana.alert.tags: "database"'
                  title: Updated maintenance window
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
              examples:
                updateMaintenanceWindowResponse:
                  summary: Update a maintenance window response
                  description: "The response returned when a maintenance window is successfully updated.\n"
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 1h
                        recurring:
                          end: '2025-12-31T00:00:00.000Z'
                          every: 2w
                          onWeekDay:
                            - FR
                        start: '2025-04-01T10:00:00.000Z'
                        timezone: US/Eastern
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "database"'
                    status: upcoming
                    title: Updated maintenance window
                    updated_at: '2025-03-15T14:30:00.000Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
        '409':
          description: Indicates that the maintenance window has already been updated by another user.
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/maintenance_window/{id}/_archive':
    post:
      tags:
        - maintenance-window
      summary: Archive a maintenance window.
      description: '[Required authorization] Route required privileges: write-maintenance-window.'
      operationId: post-maintenance-window-id-archive
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the maintenance window to be archived.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
              examples:
                archiveMaintenanceWindowResponse:
                  summary: Archive a maintenance window response
                  description: "The response returned when a maintenance window is successfully archived.\n"
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: archived
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/maintenance_window/{id}/_unarchive':
    post:
      tags:
        - maintenance-window
      summary: Unarchive a maintenance window.
      description: '[Required authorization] Route required privileges: write-maintenance-window.'
      operationId: post-maintenance-window-id-unarchive
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The identifier for the maintenance window to be unarchived.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
              examples:
                unarchiveMaintenanceWindowResponse:
                  summary: Unarchive a maintenance window response
                  description: "The response returned when a maintenance window is successfully unarchived.\n"
                  value:
                    created_at: '2025-02-25T10:00:00.000Z'
                    created_by: elastic
                    enabled: true
                    id: f0cb1780-537a-4e34-8adf-3b4336862858
                    schedule:
                      custom:
                        duration: 2h
                        recurring:
                          every: 1w
                          occurrences: 10
                          onWeekDay:
                            - MO
                            - WE
                        start: '2025-03-01T08:00:00.000Z'
                        timezone: Europe/Amsterdam
                    scope:
                      alerting:
                        query:
                          kql: 'kibana.alert.tags: "infra"'
                    status: upcoming
                    title: Weekly Maintenance Window
                    updated_at: '2025-02-25T10:00:00.000Z'
                    updated_by: elastic
        '400':
          description: Indicates an invalid schema or parameters.
        '403':
          description: Indicates that this call is forbidden.
        '404':
          description: Indicates a maintenance window with the given ID does not exist.
      x-state: Generally available; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/markdowns:
    get:
      tags:
        - Markdowns
      summary: List markdown library items
      description: 'Returns a paginated list of markdown library items. Each result includes title, description, and metadata, but not the content. Use `GET /api/markdowns/{id}` to retrieve the complete state.'
      operationId: get-markdowns
      parameters:
        - name: page
          in: query
          description: The page of results to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of results to return per page.
          schema:
            maximum: 1000
            minimum: 1
            type: number
            default: 20
        - name: query
          in: query
          description: 'Filters results by `title` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/query-dsl-simple-query-string-query) syntax. Multi-word terms require all words to match.'
          schema:
            type: string
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - data
                  - meta
                type: object
                properties:
                  data:
                    maxItems: 1000
                    minItems: 0
                    type: array
                    items:
                      required:
                        - id
                        - data
                        - meta
                      type: object
                      properties:
                        data:
                          required:
                            - title
                          type: object
                          properties:
                            description:
                              type: string
                              description: A short description of the markdown library item.
                            title:
                              type: string
                              description: The markdown library item title.
                          additionalProperties: false
                        id:
                          type: string
                          description: The markdown library item ID.
                        meta:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                      additionalProperties: false
                    description: List of markdown library items matching the query.
                  meta:
                    required:
                      - total
                    type: object
                    properties:
                      page:
                        minimum: 1
                        type: number
                        description: The returned page of results.
                        default: 1
                      per_page:
                        maximum: 1000
                        minimum: 1
                        type: number
                        description: The number of results returned per page.
                        default: 20
                      total:
                        type: number
                        description: The total number of results matching the query.
                    additionalProperties: false
                additionalProperties: false
              examples:
                searchMarkdownsResponse:
                  summary: Search markdown library items response
                  description: 'Paginated list of markdown library item summaries. Each item includes the ID, a subset of state fields (`title` and `description`), and metadata. The full `content` is not included; use `GET /api/markdowns/{id}` to retrieve a specific item.'
                  value:
                    data:
                      - data:
                          description: Intro and context for the web logs dashboard.
                          title: Web logs overview
                        id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                        meta:
                          created_at: '2026-04-13T10:00:00.000Z'
                          managed: false
                          updated_at: '2026-04-13T10:00:00.000Z'
                          version: WzU5LDFd
                    meta:
                      page: 1
                      per_page: 20
                      total: 1
        '403':
          description: forbidden
      x-codeSamples:
        - label: Search markdown library items - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/markdowns?query=welcome&per_page=10\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Search markdown library items - Console
          lang: Console
          source: "GET kbn:/api/markdowns?query=welcome&per_page=10\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Markdowns
      summary: Create a markdown library item
      description: 'Creates a new markdown library item and returns its ID, full state, and metadata.'
      operationId: post-markdowns
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - content
                - title
              type: object
              properties:
                content:
                  type: string
                  description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                description:
                  type: string
                  description: A short description of the markdown library item.
                settings:
                  type: object
                  properties:
                    open_links_in_new_tab:
                      type: boolean
                      description: Open links in a new browser tab.
                      default: true
                  additionalProperties: false
                  description: Display settings for the markdown panel.
                  default:
                    open_links_in_new_tab: true
                title:
                  minLength: 1
                  type: string
                  description: The markdown library item title.
              additionalProperties: false
            examples:
              createMarkdown:
                summary: Create a markdown library item
                value:
                  content: "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n"
                  description: Intro and context for the web logs dashboard.
                  settings:
                    open_links_in_new_tab: true
                  title: Web logs overview
      responses:
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    required:
                      - content
                      - title
                    type: object
                    properties:
                      content:
                        type: string
                        description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                      description:
                        type: string
                        description: A short description of the markdown library item.
                      settings:
                        type: object
                        properties:
                          open_links_in_new_tab:
                            type: boolean
                            description: Open links in a new browser tab.
                            default: true
                        additionalProperties: false
                        description: Display settings for the markdown panel.
                        default:
                          open_links_in_new_tab: true
                      title:
                        minLength: 1
                        type: string
                        description: The markdown library item title.
                    additionalProperties: false
                  id:
                    type: string
                    description: 'The unique ID of the markdown library item, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                createMarkdownResponse:
                  summary: Create markdown library item response
                  description: 'Response to creating a markdown library item. Returns the generated ID, the full item state in `data`, and metadata.'
                  value:
                    data:
                      content: "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n"
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
        '400':
          description: invalid request
        '403':
          description: forbidden
      x-codeSamples:
        - label: Create a markdown library item - cURL
          lang: cURL
          source: "curl -X POST \"${KIBANA_URL}/api/markdowns\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Web logs overview\",\n  \"description\": \"Intro and context for the web logs dashboard.\",\n  \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n  \"settings\": {\n    \"open_links_in_new_tab\": true\n  }\n}'\n"
        - label: Create a markdown library item - Console
          lang: Console
          source: "POST kbn:/api/markdowns\n{\n  \"title\": \"Web logs overview\",\n  \"description\": \"Intro and context for the web logs dashboard.\",\n  \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n  \"settings\": {\n    \"open_links_in_new_tab\": true\n  }\n}\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/markdowns/{id}':
    delete:
      tags:
        - Markdowns
      summary: Delete a markdown library item
      description: Permanently deletes a markdown library item by ID.
      operationId: delete-markdowns-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The markdown library item ID, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      responses:
        '204':
          description: 'No content, the markdown library item was successfully deleted.'
        '403':
          description: forbidden
        '404':
          description: not found
      x-codeSamples:
        - label: Delete a markdown library item - cURL
          lang: cURL
          source: "curl -X DELETE \"${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - label: Delete a markdown library item - Console
          lang: Console
          source: "DELETE kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Markdowns
      summary: Get a markdown library item by ID
      description: Returns the complete state of a markdown library item by ID.
      operationId: get-markdowns-id
      parameters:
        - name: id
          in: path
          description: 'The markdown library item ID, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    required:
                      - content
                      - title
                    type: object
                    properties:
                      content:
                        type: string
                        description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                      description:
                        type: string
                        description: A short description of the markdown library item.
                      settings:
                        type: object
                        properties:
                          open_links_in_new_tab:
                            type: boolean
                            description: Open links in a new browser tab.
                            default: true
                        additionalProperties: false
                        description: Display settings for the markdown panel.
                        default:
                          open_links_in_new_tab: true
                      title:
                        minLength: 1
                        type: string
                        description: The markdown library item title.
                    additionalProperties: false
                  id:
                    type: string
                    description: 'The unique ID of the markdown library item, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                getMarkdownResponse:
                  summary: Get markdown library item response
                  description: 'The full markdown library item state including `content`, `settings`, and metadata.'
                  value:
                    data:
                      content: "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n"
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
        '403':
          description: forbidden
        '404':
          description: not found
      x-codeSamples:
        - label: Get a markdown library item - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Get a markdown library item - Console
          lang: Console
          source: "GET kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Markdowns
      summary: Upsert a markdown library item
      description: "Replaces the full state of a markdown library item. Partial updates are not supported.\nTo make incremental changes, retrieve the item first, modify the fields you need, then send the complete object back.\n\nIf no item exists with the specified ID, a new one is created.\n"
      operationId: put-markdowns-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The unique ID of the markdown library item to be created or updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - content
                - title
              type: object
              properties:
                content:
                  type: string
                  description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                description:
                  type: string
                  description: A short description of the markdown library item.
                settings:
                  type: object
                  properties:
                    open_links_in_new_tab:
                      type: boolean
                      description: Open links in a new browser tab.
                      default: true
                  additionalProperties: false
                  description: Display settings for the markdown panel.
                  default:
                    open_links_in_new_tab: true
                title:
                  minLength: 1
                  type: string
                  description: The markdown library item title.
              additionalProperties: false
            examples:
              upsertMarkdown:
                summary: Upsert a markdown library item
                value:
                  content: "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n- _New:_ error rate broken down by status code\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n"
                  description: Intro and context for the web logs dashboard.
                  settings:
                    open_links_in_new_tab: true
                  title: Web logs overview
      responses:
        '200':
          description: updated
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    required:
                      - content
                      - title
                    type: object
                    properties:
                      content:
                        type: string
                        description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                      description:
                        type: string
                        description: A short description of the markdown library item.
                      settings:
                        type: object
                        properties:
                          open_links_in_new_tab:
                            type: boolean
                            description: Open links in a new browser tab.
                            default: true
                        additionalProperties: false
                        description: Display settings for the markdown panel.
                        default:
                          open_links_in_new_tab: true
                      title:
                        minLength: 1
                        type: string
                        description: The markdown library item title.
                    additionalProperties: false
                  id:
                    type: string
                    description: 'The unique ID of the markdown library item, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                updatedMarkdownResponse:
                  summary: Update markdown library item response
                  description: 'The complete updated markdown library item state after a full replacement. PUT replaces the entire item, so any fields omitted from the request are reset to their defaults.'
                  value:
                    data:
                      content: "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n- _New:_ error rate broken down by status code\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n"
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: 5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzYwLDFd
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    required:
                      - content
                      - title
                    type: object
                    properties:
                      content:
                        type: string
                        description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                      description:
                        type: string
                        description: A short description of the markdown library item.
                      settings:
                        type: object
                        properties:
                          open_links_in_new_tab:
                            type: boolean
                            description: Open links in a new browser tab.
                            default: true
                        additionalProperties: false
                        description: Display settings for the markdown panel.
                        default:
                          open_links_in_new_tab: true
                      title:
                        minLength: 1
                        type: string
                        description: The markdown library item title.
                    additionalProperties: false
                  id:
                    type: string
                    description: 'The unique ID of the markdown library item, as returned by the create or search endpoints.'
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                createdMarkdownResponse:
                  summary: Create markdown library item response (via upsert)
                  description: Returned when the upsert created a new item because no item existed with the specified ID.
                  value:
                    data:
                      content: "## Web logs overview\n\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\n\n**Key metrics in this dashboard:**\n\n- Total request count by HTTP method\n- Average response size over time\n- Geographic distribution of client IPs\n\n> Use the time picker above to narrow the dashboard to an incident window.\n\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\n"
                      description: Intro and context for the web logs dashboard.
                      settings:
                        open_links_in_new_tab: true
                      title: Web logs overview
                    id: web-logs-overview
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
        '400':
          description: invalid request
        '403':
          description: forbidden
      x-codeSamples:
        - label: Upsert a markdown library item - cURL
          lang: cURL
          source: "curl -X PUT \"${KIBANA_URL}/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"title\": \"Web logs overview\",\n  \"description\": \"Intro and context for the web logs dashboard.\",\n  \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n- _New:_ error rate broken down by status code\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n  \"settings\": {\n    \"open_links_in_new_tab\": true\n  }\n}'\n"
        - label: Upsert a markdown library item - Console
          lang: Console
          source: "PUT kbn:/api/markdowns/5e1f3a20-c4d6-11ef-be8b-3c7c2b9d1f4e\n{\n  \"title\": \"Web logs overview\",\n  \"description\": \"Intro and context for the web logs dashboard.\",\n  \"content\": \"## Web logs overview\\n\\nA quick reference for the **Kibana sample web logs** dataset (`kibana_sample_data_logs`).\\n\\n**Key metrics in this dashboard:**\\n\\n- Total request count by HTTP method\\n- Average response size over time\\n- Geographic distribution of client IPs\\n- _New:_ error rate broken down by status code\\n\\n> Use the time picker above to narrow the dashboard to an incident window.\\n\\nFor field reference, see the [sample data documentation](https://www.elastic.co/docs/manage-data/ingest/sample-data).\\n\",\n  \"settings\": {\n    \"open_links_in_new_tab\": true\n  }\n}\n"
      x-state: Experimental; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/ml/saved_objects/sync:
    get:
      tags:
        - ml
      summary: Sync saved objects in the default space
      description: "Synchronizes Kibana saved objects for machine learning jobs and trained models in the default space. You must have `all` privileges for the **Machine Learning** feature in the **Analytics** section of the Kibana feature privileges. This API runs automatically when you start Kibana and periodically thereafter.\n"
      operationId: mlSync
      parameters:
        - $ref: '#/components/parameters/Machine_learning_APIs_simulateParam'
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Machine_learning_APIs_mlSync200Response'
              examples:
                syncExample:
                  $ref: '#/components/examples/Machine_learning_APIs_mlSyncExample'
        '401':
          description: Authorization information is missing or invalid.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Machine_learning_APIs_mlSync4xxResponse'
              examples:
                syncExample:
                  $ref: '#/components/examples/Machine_learning_APIs_mlSync401Example'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/ml/saved_objects/update_jobs_spaces:
    post:
      tags:
        - ml
      summary: Update jobs spaces
      description: Update a list of jobs to add and/or remove them from given spaces.
      operationId: mlUpdateJobsSpaces
      requestBody:
        content:
          application/json:
            examples:
              updateADJobSpacesRequest:
                value:
                  jobIds:
                    - test-job
                  jobType: anomaly-detector
                  spacesToAdd:
                    - default
                  spacesToRemove:
                    - '*'
              updateDFAJobSpacesRequest:
                value:
                  jobIds:
                    - test-job
                  jobType: data-frame-analytics
                  spacesToAdd:
                    - default
                  spacesToRemove:
                    - '*'
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              examples:
                successADResponse:
                  value:
                    test-job:
                      success: true
                      type: anomaly-detector
                successDFAResponse:
                  value:
                    test-job:
                      success: true
                      type: data-frame-analytics
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/ml/saved_objects/update_trained_models_spaces:
    post:
      tags:
        - ml
      summary: Update trained models spaces
      description: Update a list of trained models to add and/or remove them from given spaces.
      operationId: mlUpdateTrainedModelsSpaces
      requestBody:
        content:
          application/json:
            examples:
              updateTrainedModelsSpacesRequest:
                value:
                  modelIds:
                    - test-model
                  spacesToAdd:
                    - default
                  spacesToRemove:
                    - '*'
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              examples:
                successTMResponse:
                  value:
                    test-model:
                      success: true
                      type: trained-model"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/note:
    delete:
      tags:
        - Security Timeline API
      summary: Delete one or more notes
      description: "Deletes notes by saved object ID. Send either `noteId` (single ID) or `noteIds` (array of IDs) in the JSON body.\n\nThe response has HTTP 200 with an empty body on success.\n\nRequires the **Timeline and Notes** write privilege (`notes_write`).\n"
      operationId: DeleteNote
      requestBody:
        description: "Exactly one shape: `{ \"noteId\": \"<id>\" }` for a single delete, or `{ \"noteIds\": [\"<id>\", ...] }` for bulk delete.\n`noteIds` may be null in some clients; prefer an empty array or omit unused fields when possible.\n"
        content:
          application/json:
            schema:
              oneOf:
                - required:
                    - noteId
                  type:
                    - 'null'
                    - object
                  properties:
                    noteId:
                      type: string
                      description: Saved object ID of the note to delete.
                - required:
                    - noteIds
                  type:
                    - 'null'
                    - object
                  properties:
                    noteIds:
                      type:
                        - 'null'
                        - array
                      items:
                        type: string
                      description: Saved object IDs of the notes to delete.
            examples:
              deleteOne:
                summary: Delete a single note by id
                value:
                  noteId: 709f99c6-89b6-4953-9160-35945c8e174e
        required: true
      responses:
        '200':
          description: The notes were deleted successfully. Response body is empty.
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Timeline API
      summary: Get notes
      description: "Returns Security Timeline notes as saved objects.\n\n**Query modes (mutually exclusive branches on the server):**\n\n1. **`documentIds` is set** — Returns notes whose `eventId` matches the given Elasticsearch document `_id` (single string or array). Pagination query parameters (`page`, `perPage`, etc.) are **not** applied; the server uses a fixed page size (up to 10000 notes).\n\n2. **`savedObjectIds` is set** — Returns notes linked to the given Timeline saved object id(s). Same fixed cap as above; list-mode query parameters are **not** applied.\n\n3. **Neither `documentIds` nor `savedObjectIds`** — Lists notes using saved-objects find semantics: `page` (default 1), `perPage` (default 10), optional `search`, `sortField`, `sortOrder`, `filter`, `createdByFilter`, and `associatedFilter`.\n\nRequires the **Timeline and Notes** read privilege (`notes_read`).\n"
      operationId: GetNotes
      parameters:
        - name: documentIds
          in: query
          description: "Event document `_id` values to match against each note's `eventId`. When this parameter is present, the response is all matching notes (up to the server's hard limit), not a paged list using `page`/`perPage`.\n"
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_DocumentIds'
          examples:
            multiple:
              summary: Multiple document ids (array)
              value:
                - id-one
                - id-two
            single:
              summary: Single document id
              value: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
        - name: savedObjectIds
          in: query
          description: "Timeline `savedObjectId` value(s). Returns notes that reference those timelines. When present, list-mode pagination parameters are not used; up to the server's hard limit of notes may be returned.\n"
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_SavedObjectIds'
          examples:
            singleTimeline:
              summary: Single timeline id
              value: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
        - name: page
          in: query
          description: "Page number for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 1.\n"
          schema:
            type:
              - 'null'
              - string
          example: '1'
        - name: perPage
          in: query
          description: "Page size for list mode (when `documentIds` and `savedObjectIds` are omitted). Passed as a string; default 10.\n"
          schema:
            type:
              - 'null'
              - string
          example: '20'
        - name: search
          in: query
          description: Search string for saved-objects find (list mode only).
          schema:
            type:
              - 'null'
              - string
        - name: sortField
          in: query
          description: Field to sort by for saved-objects find (list mode only).
          schema:
            type:
              - 'null'
              - string
        - name: sortOrder
          in: query
          description: Sort order (`asc` or `desc`) for saved-objects find (list mode only).
          schema:
            type:
              - 'null'
              - string
          example: desc
        - name: filter
          in: query
          description: "Kuery filter string combined with other list-mode filters (for example `createdByFilter` or `associatedFilter`). Typed as a string for API compatibility; interpreted by the saved-objects layer (list mode only).\n"
          schema:
            type:
              - 'null'
              - string
        - name: createdByFilter
          in: query
          description: "Kibana user profile **UID** (UUID). The server resolves the user's display identifiers and returns notes whose `createdBy` matches any of them (list mode only).\n"
          schema:
            type:
              - 'null'
              - string
          example: f1c2d3e4-5b6a-7890-abcd-ef1234567890
        - name: associatedFilter
          in: query
          description: "Restricts notes by how they relate to a Timeline and/or an event document (list mode only). Some values apply extra filtering after the query. Ignored when `documentIds` or `savedObjectIds` is used.\n"
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_AssociatedFilterType'
      responses:
        '200':
          description: Notes and total count for the requested mode.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_GetNotesResult'
              examples:
                notesPage:
                  summary: Paged notes for a timeline
                  value:
                    notes:
                      - eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                        note: Escalated to tier-2 analyst
                        noteId: 709f99c6-89b6-4953-9160-35945c8e174e
                        timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                        version: WzQ2LDFd
                    totalCount: 1
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - Security Timeline API
      summary: Add or update a note
      description: "Creates a new note or updates an existing one.\n\n**Create:** Send `note` and omit `noteId` to create a new saved object.\n\n**Update:** Send `note` with the changed fields and set `noteId` to the note's saved object ID. Optionally include `version` for optimistic concurrency when the client has it from a prior read.\n\nRequires the **Timeline and Notes** write privilege (`notes_write`).\n"
      externalDocs:
        description: Add or update a note on a Timeline
        url: https://www.elastic.co/guide/en/security/current/timeline-api-update.html
      operationId: PersistNoteRoute
      requestBody:
        description: "Body must include the `note` object. For updates, include `noteId` (and optionally `version`).\nTo attach a note to a specific event, set `note.eventId` to that event's document `_id`; for a timeline-wide note, omit or clear `eventId` per product rules.\n"
        content:
          application/json:
            schema:
              required:
                - note
              type: object
              properties:
                note:
                  $ref: '#/components/schemas/Security_Timeline_API_BareNote'
                noteId:
                  type:
                    - 'null'
                    - string
                  description: The `savedObjectId` of the note to update. Omit when creating a new note.
                  example: 709f99c6-89b6-4953-9160-35945c8e174e
                version:
                  type:
                    - 'null'
                    - string
                  description: Saved object version string from a previous read; optional on update.
                  example: WzQ2LDFd
            examples:
              addNote:
                summary: Add a note on an event
                value:
                  note:
                    eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                    note: Escalated to tier-2 analyst
                    timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
        required: true
      responses:
        '200':
          description: 'The persisted note, including `noteId` and `version`.'
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ResponseNote'
              examples:
                persisted:
                  summary: Persisted note wrapper
                  value:
                    note:
                      eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                      note: Escalated to tier-2 analyst
                      noteId: 709f99c6-89b6-4953-9160-35945c8e174e
                      timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      version: WzQ2LDFd
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/observability_ai_assistant/chat/complete:
    post:
      tags:
        - observability_ai_assistant
      summary: Generate a chat completion
      description: "Create a new chat completion by using the Observability AI Assistant.\n\nThe API returns the model's response based on the current conversation context.\n\nIt also handles any tool requests within the conversation, which may trigger multiple calls to the underlying large language model (LLM).\n\nThis functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
      operationId: observability-ai-assistant-chat-complete
      requestBody:
        content:
          application/json:
            schema:
              required:
                - messages
                - connectorId
                - persist
              type: object
              properties:
                actions:
                  type: array
                  items:
                    $ref: '#/components/schemas/Observability_AI_Assistant_API_Function'
                connectorId:
                  type: string
                  description: A unique identifier for the connector.
                conversationId:
                  type: string
                  description: A unique identifier for the conversation if you are continuing an existing conversation.
                disableFunctions:
                  type: boolean
                  description: 'Flag indicating whether all function calls should be disabled for the conversation. If true, no calls to functions will be made.'
                instructions:
                  type: array
                  items:
                    $ref: '#/components/schemas/Observability_AI_Assistant_API_Instruction'
                  description: 'An array of instruction objects, which can be either simple strings or detailed objects.'
                messages:
                  type: array
                  items:
                    $ref: '#/components/schemas/Observability_AI_Assistant_API_Message'
                  description: An array of message objects containing the conversation history.
                persist:
                  type: boolean
                  description: 'Indicates whether the conversation should be saved to storage. If true, the conversation will be saved and will be available in Kibana.'
                title:
                  type: string
                  description: A title for the conversation.
            examples:
              chatCompleteRequestExample:
                $ref: '#/components/examples/Observability_AI_Assistant_API_ChatCompleteRequestExample'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
              examples:
                chatCompleteResponseExample:
                  $ref: '#/components/examples/Observability_AI_Assistant_API_ChatCompleteResponseExample'
      x-codeSamples:
        - lang: cURL
          source: "curl --request POST 'localhost:5601/api/observability_ai_assistant/chat/complete' -u <username>:<password> -H 'kbn-xsrf: true' -H \"Content-Type: application/json\" --data '\n{\n\"connectorId\": \"<connectorId>\",\n\"disableFunctions\": false,\n  \"messages\": [\n    {\n      \"@timestamp\": \"2025-06-25T23:45:00.000Z\",\n      \"message\": {\n        \"role\": \"user\",\n        \"content\": \"Is my Elasticsearch cluster healthy right now?\"\n      }\n    }\n  ],\n\"persist\": false,\n\"actions\": [\n  {\n    \"name\": \"get_cluster_health\",\n    \"description\": \"Fetch the current Elasticsearch cluster-health status and key metrics.\",\n    \"parameters\": {\n      \"type\": \"object\",\n      \"properties\": {\n        \"includeShardStats\": {\n          \"type\": \"boolean\",\n          \"default\": false\n        }\n      }\n    }\n  }\n],\n\"instructions\": [\"When the user asks about Elasticsearch cluster health, use the get_cluster_health tool to retrieve cluster health, then summarize the response in plain English.\"]\n}'\n"
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/history:
    get:
      tags:
        - Security Osquery API
      summary: Get unified query history
      description: "Get a unified, time-sorted history of live, rule-triggered, and scheduled osquery executions. The response uses cursor-based pagination.\n"
      operationId: OsqueryGetUnifiedHistory
      parameters:
        - name: pageSize
          in: query
          description: The number of results to return per page.
          schema:
            maximum: 100
            minimum: 1
            type: integer
            description: The number of results to return per page.
            default: 20
        - name: nextPage
          in: query
          description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
          schema:
            type: string
            description: A base64-encoded cursor for pagination. Use the value from the previous response to fetch the next page.
        - name: kuery
          in: query
          description: 'A search string to filter history entries by pack name, query text, or query ID.'
          schema:
            type: string
            description: 'A search string to filter history entries by pack name, query text, or query ID.'
        - name: userIds
          in: query
          description: Comma-separated list of user IDs to filter live query history.
          schema:
            type: string
            description: Comma-separated list of user IDs to filter live query history.
            example: 'elastic,admin'
        - name: sourceFilters
          in: query
          description: 'Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.'
          schema:
            type: string
            description: 'Comma-separated list of source types to include. Valid values are `live`, `rule`, and `scheduled`.'
            example: 'live,scheduled'
        - name: startDate
          in: query
          description: The start of the time range filter (ISO 8601).
          schema:
            type: string
            description: The start of the time range filter (ISO 8601).
            example: '2024-01-01T00:00:00Z'
        - name: endDate
          in: query
          description: The end of the time range filter (ISO 8601).
          schema:
            type: string
            description: The end of the time range filter (ISO 8601).
            example: '2024-12-31T23:59:59Z'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetUnifiedHistoryResponse'
              examples:
                unifiedHistoryExample:
                  summary: Example unified history response
                  value:
                    data:
                      - actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                        agentCount: 5
                        errorCount: 0
                        id: 3c42c847-eb30-4452-80e0-728584042334
                        queryName: uptime_query
                        queryText: select * from uptime;
                        source: Live
                        sourceType: live
                        successCount: 5
                        timestamp: '2024-07-26T09:59:32.220Z'
                        totalRows: 42
                        userId: elastic
                      - agentCount: 10
                        errorCount: 1
                        executionCount: 3
                        id: pack_my_pack_uptime_3
                        packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                        packName: My Pack
                        plannedTime: '2024-07-26T09:00:00.000Z'
                        queryName: uptime
                        queryText: select * from uptime;
                        scheduleId: pack_my_pack_uptime
                        source: Scheduled
                        sourceType: scheduled
                        successCount: 9
                        timestamp: '2024-07-26T09:00:00.000Z'
                        totalRows: 100
                    hasMore: true
                    nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/live_queries:
    get:
      tags:
        - Security Osquery API
      summary: Get live queries
      description: Get a list of all live queries.
      operationId: OsqueryFindLiveQueries
      parameters:
        - name: kuery
          in: query
          description: A KQL search string to filter live queries.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - name: page
          in: query
          description: The page number to return.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - name: pageSize
          in: query
          description: The number of results to return per page.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - name: sort
          in: query
          description: The field to sort results by.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - name: sortOrder
          in: query
          description: The sort order.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryResponse'
              examples:
                liveQueriesList:
                  summary: A list of recent live queries
                  value:
                    data:
                      items:
                        - _source:
                            '@timestamp': '2023-10-31T00:00:00Z'
                            action_id: 3c42c847-eb30-4452-80e0-728584042334
                            agents:
                              - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                            expiration: '2023-10-31T00:00:00Z'
                            queries:
                              - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                                agents:
                                  - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                                ecs_mapping:
                                  host.uptime:
                                    field: total_seconds
                                id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                                query: select * from uptime;
                                saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                            user_id: elastic
                      total: 1
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Osquery API
      summary: Create a live query
      description: Create and run a live query.
      operationId: OsqueryCreateLiveQuery
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryRequestBody'
            examples:
              singleQueryAllAgents:
                summary: Run a single query on all agents
                value:
                  agent_all: true
                  ecs_mapping:
                    host.uptime:
                      field: total_seconds
                  query: select * from uptime;
              targetedQuery:
                summary: Run a query against specific agents
                value:
                  agent_ids:
                    - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                  query: select * from processes;
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateLiveQueryResponse'
              examples:
                liveQueryCreated:
                  summary: Live query created
                  value:
                    data:
                      '@timestamp': '2022-07-26T09:59:32.220Z'
                      action_id: 3c42c847-eb30-4452-80e0-728584042334
                      agent_all: true
                      agents:
                        - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                      expiration: '2022-07-26T10:04:32.220Z'
                      input_type: osquery
                      queries:
                        - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                          agents:
                            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                          id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                          query: select * from uptime;
                          timeout: 120
                      type: INPUT_ACTION
                      user_id: elastic
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/live_queries/{id}':
    get:
      tags:
        - Security Osquery API
      summary: Get live query details
      description: Get the details of a live query using the query ID.
      operationId: OsqueryGetLiveQueryDetails
      parameters:
        - name: id
          in: path
          description: The ID of the live query.
          required: true
          schema:
            type: string
            description: The ID of the live query result you want to retrieve.
            example: 3c42c847-eb30-4452-80e0-728584042334
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindLiveQueryDetailsResponse'
              examples:
                liveQueryDetails:
                  summary: Live query details with execution status
                  value:
                    data:
                      '@timestamp': '2022-07-26T09:59:32.220Z'
                      action_id: 3c42c847-eb30-4452-80e0-728584042334
                      agents:
                        - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                      expiration: '2022-07-26T10:04:32.220Z'
                      queries:
                        - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                          agents:
                            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                          docs: 1
                          failed: 0
                          id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                          pending: 0
                          query: select * from uptime;
                          responded: 1
                          status: completed
                          successful: 1
                      status: completed
                      user_id: elastic
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/live_queries/{id}/results/{actionId}':
    get:
      tags:
        - Security Osquery API
      summary: Get live query results
      description: Get the results of a live query using the query action ID.
      operationId: OsqueryGetLiveQueryResults
      parameters:
        - name: id
          in: path
          description: The ID of the live query.
          required: true
          schema:
            type: string
            description: The ID of the live query result you want to retrieve.
            example: 3c42c847-eb30-4452-80e0-728584042334
        - name: actionId
          in: path
          description: The ID of the query action.
          required: true
          schema:
            type: string
            description: The ID of the query action that generated the live query results.
            example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
        - name: kuery
          in: query
          description: A KQL search string to filter results.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - name: page
          in: query
          description: The page number to return.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - name: pageSize
          in: query
          description: The number of results to return per page.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - name: sort
          in: query
          description: The field to sort results by.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - name: sortOrder
          in: query
          description: The sort order.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetLiveQueryResultsResponse'
              examples:
                liveQueryResults:
                  summary: Result rows from a live query execution
                  value:
                    data:
                      edges:
                        - _id: doc1
                          _source:
                            action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                            agent:
                              id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                            osquery:
                              total_seconds: '12345'
                        - _id: doc2
                          _source:
                            action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                            agent:
                              id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                            osquery:
                              total_seconds: '67890'
                      total: 2
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/live_queries/{id}/results/{actionId}/_export':
    post:
      tags:
        - Security Osquery API
      summary: Export live query results
      description: "Export the results of a live query action as a downloadable file. The response is a streaming file attachment in the requested format.\n"
      operationId: OsqueryExportLiveQueryResults
      parameters:
        - name: id
          in: path
          description: The ID of the live query (parent action ID).
          required: true
          schema:
            type: string
            description: The ID of the live query.
            example: 3c42c847-eb30-4452-80e0-728584042334
        - name: actionId
          in: path
          description: The query action ID whose results are exported. Filters the export to rows for this specific per-agent action.
          required: true
          schema:
            type: string
            description: The ID of the query action.
            example: 609c4c66-ba3d-43fa-afdd-53e244577aa0
        - name: format
          in: query
          description: The output format of the exported file.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_ExportFormat'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_ExportRequestBody'
            examples:
              filteredExport:
                summary: Export only rows matching a KQL filter
                value:
                  kuery: 'user.name: "root"'
      responses:
        '200':
          description: "A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.\n"
          headers:
            Content-Disposition:
              description: 'Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-results-{actionId}-{timestamp}.ndjson"`.'
              schema:
                type: string
                example: attachment; filename="osquery-results-609c4c66-ba3d-43fa-afdd-53e244577aa0-2026-04-30T09-12-00-000Z.ndjson"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_ExportJsonResponse'
              examples:
                jsonExport:
                  summary: JSON export with metadata and results
                  value:
                    _meta:
                      action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                      exported_by: elastic
                      format: json
                      query: SELECT * FROM users;
                      timestamp: '2026-04-30T09:12:00.000Z'
                      total_results: 2
                    results:
                      - '@timestamp': '2026-04-30T09:11:58.321Z'
                        agent:
                          id: 980a6b73-0b03-4d1e-8915-67c202e4a980
                          name: prod-host-1
                        user:
                          id: '1000'
                          name: ubuntu
            application/ndjson:
              schema:
                type: string
                description: "Newline-delimited JSON stream. The first line is a metadata object; each subsequent line is a result row.\n"
                format: binary
              examples:
                ndjsonExport:
                  summary: NDJSON export with a leading metadata line
                  value: "{\"_meta\":{\"action_id\":\"609c4c66-ba3d-43fa-afdd-53e244577aa0\",\"query\":\"SELECT * FROM users;\",\"timestamp\":\"2026-04-30T09:12:00.000Z\",\"exported_by\":\"elastic\",\"format\":\"ndjson\",\"total_results\":2}}\n{\"@timestamp\":\"2026-04-30T09:11:58.321Z\",\"agent\":{\"id\":\"980a6b73-0b03-4d1e-8915-67c202e4a980\",\"name\":\"prod-host-1\"},\"user\":{\"id\":\"1000\",\"name\":\"ubuntu\"}}\n{\"@timestamp\":\"2026-04-30T09:11:58.456Z\",\"agent\":{\"id\":\"980a6b73-0b03-4d1e-8915-67c202e4a980\",\"name\":\"prod-host-1\"},\"user\":{\"id\":\"0\",\"name\":\"root\"}}\n"
            text/csv:
              schema:
                type: string
                description: "CSV file with a header row derived from the ECS mapping of the originating query (when available). No metadata block is included in CSV output.\n"
                format: binary
              examples:
                csvExport:
                  summary: CSV export with a header row
                  value: "agent.name,agent.id,user.id,user.name\nprod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,1000,ubuntu\nprod-host-1,980a6b73-0b03-4d1e-8915-67c202e4a980,0,root\n"
        '400':
          description: "Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.\n"
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: 'Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.'
              examples:
                rowLimitExceeded:
                  summary: Result count exceeds the export limit
                  value:
                    message: 'Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.'
        '403':
          description: "The authenticated user does not have the `osquery-readLiveQueries` privilege required to export live query results.\n"
        '404':
          description: "The parent live query action `{id}` was found but does not contain a query whose `action_id` matches `{actionId}`. This typically means the `id` and `actionId` URL parameters refer to different queries.\n"
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: Live query action not found
              examples:
                actionNotFound:
                  summary: The id/actionId pair refers to different queries
                  value:
                    message: Live query action not found
      x-state: Generally available; Added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/packs:
    get:
      tags:
        - Security Osquery API
      summary: Get packs
      description: Get a list of all query packs.
      operationId: OsqueryFindPacks
      parameters:
        - name: page
          in: query
          description: The page number to return.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - name: pageSize
          in: query
          description: The number of results to return per page.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - name: sort
          in: query
          description: The field to sort results by.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - name: sortOrder
          in: query
          description: The sort order.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPacksResponse'
              examples:
                packsList:
                  summary: A list of query packs
                  value:
                    data:
                      - created_at: '2025-02-26T13:37:30.452Z'
                        created_by: elastic
                        description: My pack
                        enabled: true
                        name: my_pack
                        queries:
                          - id: ports
                            interval: 60
                            query: SELECT * FROM listening_ports;
                            removed: false
                            snapshot: true
                            timeout: 120
                        saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                        updated_at: '2025-02-26T13:37:30.452Z'
                        updated_by: elastic
                        version: 1
                    page: 1
                    per_page: 20
                    total: 1
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Osquery API
      summary: Create a pack
      description: Create a query pack.
      operationId: OsqueryCreatePacks
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreatePacksRequestBody'
            examples:
              createPack:
                summary: Create a pack with a single query
                value:
                  description: My pack
                  enabled: true
                  name: my_pack
                  policy_ids:
                    - my_policy_id
                  queries:
                    ports:
                      ecs_mapping:
                        client.port:
                          field: port
                      interval: 60
                      query: SELECT * FROM listening_ports;
                      timeout: 120
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreatePacksResponse'
              examples:
                packCreated:
                  summary: Pack created
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: true
                      name: my_pack
                      policy_ids:
                        - my_policy_id
                      queries:
                        ports:
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: [ ]
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
                      version: 1
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/packs/{id}':
    delete:
      tags:
        - Security Osquery API
      summary: Delete a pack
      description: Delete a query pack using the pack ID.
      operationId: OsqueryDeletePacks
      parameters:
        - name: id
          in: path
          description: The pack ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
              examples:
                packDeleted:
                  summary: Pack deleted (empty response body)
                  value: { }
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Osquery API
      summary: Get pack details
      description: Get the details of a query pack using the pack ID.
      operationId: OsqueryGetPacksDetails
      parameters:
        - name: id
          in: path
          description: The pack ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindPackResponse'
              examples:
                packDetails:
                  summary: Pack details
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: true
                      name: my_pack
                      policy_ids:
                        - my_policy_id
                      queries:
                        ports:
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: { }
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
                      version: 1
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Osquery API
      summary: Update a pack
      description: "Update a query pack using the pack ID.\n> info\n> You cannot update a prebuilt pack.\n"
      operationId: OsqueryUpdatePacks
      parameters:
        - name: id
          in: path
          description: The pack ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksRequestBody'
            examples:
              renamePack:
                summary: Rename a pack and update its description
                value:
                  description: Updated pack description
                  enabled: true
                  name: my_pack_renamed
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdatePacksResponse'
              examples:
                packUpdated:
                  summary: Pack updated
                  value:
                    data:
                      description: Updated pack description
                      enabled: true
                      name: my_pack_renamed
                      policy_ids:
                        - my_policy_id
                      queries:
                        ports:
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: [ ]
                      updated_at: '2025-02-27T10:00:00.000Z'
                      updated_by: elastic
                      version: 2
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/packs/{id}/copy':
    post:
      tags:
        - Security Osquery API
      summary: Copy a pack
      description: 'Create a copy of a query pack with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`). The copied pack is always created with `enabled` set to `false`.'
      operationId: OsqueryCopyPacks
      parameters:
        - name: id
          in: path
          description: The ID of the pack to copy.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PackId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopyPacksResponse'
              examples:
                copyPackExample:
                  summary: Example response for copying a pack
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: My pack
                      enabled: false
                      name: my_pack_copy
                      policy_ids: [ ]
                      queries:
                        - ecs_mapping:
                            - key: client.port
                              value:
                                field: port
                          id: ports
                          interval: 60
                          query: SELECT * FROM listening_ports;
                          removed: false
                          snapshot: true
                          timeout: 120
                      saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
                      shards: [ ]
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/osquery/saved_queries:
    get:
      tags:
        - Security Osquery API
      summary: Get saved queries
      description: Get a list of all saved queries.
      operationId: OsqueryFindSavedQueries
      parameters:
        - name: page
          in: query
          description: The page number to return.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - name: pageSize
          in: query
          description: The number of results to return per page.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - name: sort
          in: query
          description: The field to sort results by.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - name: sortOrder
          in: query
          description: The sort order.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryResponse'
              examples:
                savedQueriesList:
                  summary: A list of saved queries
                  value:
                    data:
                      - created_at: '2025-02-26T13:37:30.452Z'
                        created_by: elastic
                        description: Saved query description
                        ecs_mapping:
                          host.uptime:
                            field: total_seconds
                        id: my_saved_query
                        interval: '60'
                        platform: 'linux,darwin'
                        query: select * from uptime;
                        saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                        timeout: 120
                        updated_at: '2025-02-26T13:37:30.452Z'
                        updated_by: elastic
                    page: 1
                    per_page: 20
                    total: 1
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Osquery API
      summary: Create a saved query
      description: Create and save a query for later use.
      operationId: OsqueryCreateSavedQuery
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryRequestBody'
            examples:
              createSavedQuery:
                summary: Create a saved query
                value:
                  description: Saved query description
                  ecs_mapping:
                    host.uptime:
                      field: total_seconds
                  id: my_saved_query
                  interval: '60'
                  platform: 'linux,darwin'
                  query: select * from uptime;
                  timeout: 120
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CreateSavedQueryResponse'
              examples:
                savedQueryCreated:
                  summary: Saved query created
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query
                      interval: '60'
                      platform: 'linux,darwin'
                      query: select * from uptime;
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/saved_queries/{id}':
    delete:
      tags:
        - Security Osquery API
      summary: Delete a saved query
      description: Delete a saved query using the query ID.
      operationId: OsqueryDeleteSavedQuery
      parameters:
        - name: id
          in: path
          description: The saved query ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_DefaultSuccessResponse'
              examples:
                savedQueryDeleted:
                  summary: Saved query deleted (empty response body)
                  value: { }
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Osquery API
      summary: Get saved query details
      description: Get the details of a saved query using the query ID.
      operationId: OsqueryGetSavedQueryDetails
      parameters:
        - name: id
          in: path
          description: The saved query ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_FindSavedQueryDetailResponse'
              examples:
                savedQueryDetails:
                  summary: Saved query details
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query
                      interval: '60'
                      platform: 'linux,darwin'
                      query: select * from uptime;
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security Osquery API
      summary: Update a saved query
      description: "Update a saved query using the query ID.\n> info\n> You cannot update a prebuilt saved query.\n"
      operationId: OsqueryUpdateSavedQuery
      parameters:
        - name: id
          in: path
          description: The saved query ID.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryRequestBody'
            examples:
              updateSavedQuery:
                summary: Update a saved query
                value:
                  description: Updated saved query description
                  id: my_saved_query
                  interval: '120'
                  platform: 'linux,darwin'
                  query: select * from osquery_info;
                  timeout: 60
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_UpdateSavedQueryResponse'
              examples:
                savedQueryUpdated:
                  summary: Saved query updated
                  value:
                    data:
                      description: Updated saved query description
                      id: my_saved_query
                      interval: '120'
                      platform: 'linux,darwin'
                      query: select * from osquery_info;
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      timeout: 60
                      updated_at: '2025-02-27T10:00:00.000Z'
                      updated_by: elastic
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/saved_queries/{id}/copy':
    post:
      tags:
        - Security Osquery API
      summary: Copy a saved query
      description: 'Create a copy of a saved query with a unique name by appending a `_copy` suffix. If the name already exists, a numeric suffix is added (e.g., `_copy_2`).'
      operationId: OsqueryCopySavedQuery
      parameters:
        - name: id
          in: path
          description: The ID of the saved query to copy.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_CopySavedQueryResponse'
              examples:
                copySavedQueryExample:
                  summary: Example response for copying a saved query
                  value:
                    data:
                      created_at: '2025-02-26T13:37:30.452Z'
                      created_by: elastic
                      description: Saved query description
                      ecs_mapping:
                        host.uptime:
                          field: total_seconds
                      id: my_saved_query_copy
                      interval: '60'
                      platform: 'linux,darwin'
                      query: select * from uptime;
                      removed: false
                      saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
                      snapshot: true
                      timeout: 120
                      updated_at: '2025-02-26T13:37:30.452Z'
                      updated_by: elastic
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/scheduled_results/{scheduleId}/{executionCount}':
    get:
      tags:
        - Security Osquery API
      summary: Get scheduled action results
      description: "Get paginated per-agent action results for a specific scheduled query execution, with success/failure aggregation and execution metadata (pack name, query name/text, timestamp).\n"
      operationId: OsqueryGetScheduledActionResults
      parameters:
        - name: scheduleId
          in: path
          description: The schedule ID of the scheduled query.
          required: true
          schema:
            type: string
            description: The schedule ID of the scheduled query.
            example: pack_my_pack_uptime
        - name: executionCount
          in: path
          description: The execution count for this scheduled query run.
          required: true
          schema:
            type: integer
            description: The execution count for this scheduled query run.
            example: 3
        - name: kuery
          in: query
          description: The kuery to filter the results by.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - name: page
          in: query
          description: The page number to return. The default is 1.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - name: pageSize
          in: query
          description: The number of results to return per page. The default is 20.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - name: sort
          in: query
          description: The field that is used to sort the results.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - name: sortOrder
          in: query
          description: Specifies the sort order.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetScheduledActionResultsResponse'
              examples:
                scheduledActionResultsExample:
                  summary: Example scheduled action results response
                  value:
                    aggregations:
                      failed: 1
                      pending: 0
                      successful: 9
                      totalResponded: 10
                      totalRowCount: 42
                    currentPage: 0
                    edges:
                      - _id: result-001
                        fields:
                          agent_id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
                          rows_count: 5
                          status: success
                    metadata:
                      executionCount: 3
                      packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                      packName: My Pack
                      queryName: uptime
                      queryText: select * from uptime;
                      scheduleId: pack_my_pack_uptime
                      timestamp: '2024-07-26T09:00:00.000Z'
                    pageSize: 20
                    total: 10
                    totalPages: 1
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/scheduled_results/{scheduleId}/{executionCount}/_export':
    post:
      tags:
        - Security Osquery API
      summary: Export scheduled query results
      description: "Export all result rows for a specific scheduled query execution as a downloadable file. The response is a streaming file attachment in the requested format.\n"
      operationId: OsqueryExportScheduledQueryResults
      parameters:
        - name: scheduleId
          in: path
          description: The schedule ID of the scheduled query.
          required: true
          schema:
            type: string
            description: The schedule ID of the scheduled query.
            example: 90f342ee-9c05-4844-849b-173993234f22
        - name: executionCount
          in: path
          description: The execution counter for the scheduled query run whose results are exported. Must be a non-negative integer.
          required: true
          schema:
            minimum: 0
            type: integer
            description: The execution counter for this scheduled query run.
            example: 17384
        - name: format
          in: query
          description: The output format of the exported file.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_ExportFormat'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_Osquery_API_ExportRequestBody'
            examples:
              filteredExport:
                summary: Export only rows matching a KQL filter
                value:
                  kuery: 'agent.name: "prod-host-1"'
      responses:
        '200':
          description: "A downloadable file in the requested format. The `Content-Disposition` header contains the suggested filename.\n"
          headers:
            Content-Disposition:
              description: 'Attachment disposition with a generated filename, e.g. `attachment; filename="osquery-scheduled-results-{scheduleId}-{executionCount}-{timestamp}.csv"`.'
              schema:
                type: string
                example: attachment; filename="osquery-scheduled-results-90f342ee-9c05-4844-849b-173993234f22-17384-2026-04-30T09-12-00-000Z.csv"
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_ExportJsonResponse'
              examples:
                jsonExport:
                  summary: JSON export with metadata and results
                  value:
                    _meta:
                      action_id: 90f342ee-9c05-4844-849b-173993234f22
                      execution_count: 17384
                      exported_by: elastic
                      format: json
                      timestamp: '2026-04-30T09:12:00.000Z'
                      total_results: 1
                    results:
                      - '@timestamp': '2026-04-30T09:11:58.321Z'
                        agent:
                          id: 5b1bb334-a23d-4006-80fe-bd129b979c9f
                          name: prod-host-1
                        osquery:
                          uid: '1000'
                          username: ubuntu
            application/ndjson:
              schema:
                type: string
                description: "Newline-delimited JSON stream. The first line is a metadata object (includes `execution_count`); each subsequent line is a result row.\n"
                format: binary
              examples:
                ndjsonExport:
                  summary: NDJSON export with a leading metadata line
                  value: "{\"_meta\":{\"action_id\":\"90f342ee-9c05-4844-849b-173993234f22\",\"execution_count\":17384,\"timestamp\":\"2026-04-30T09:12:00.000Z\",\"exported_by\":\"elastic\",\"format\":\"ndjson\",\"total_results\":32}}\n{\"@timestamp\":\"2026-04-30T09:11:58.321Z\",\"agent\":{\"id\":\"5b1bb334-a23d-4006-80fe-bd129b979c9f\",\"name\":\"prod-host-1\"},\"osquery\":{\"uid\":\"1000\",\"username\":\"ubuntu\"}}\n"
            text/csv:
              schema:
                type: string
                description: "CSV file with a header row. No metadata block is included in CSV output.\n"
                format: binary
              examples:
                csvExport:
                  summary: CSV export with a header row
                  value: "osquery.description,agent.name,agent.id,osquery.uid,osquery.username\nUbuntu,prod-host-1,5b1bb334-a23d-4006-80fe-bd129b979c9f,1000,ubuntu\nroot,prod-host-1,5b1bb334-a23d-4006-80fe-bd129b979c9f,0,root\n"
        '400':
          description: "Bad request. Possible causes: invalid or missing `format` query parameter, malformed KQL in the request body, invalid `esFilters`, or the result count exceeds the 500,000-row limit.\n"
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                    example: 'Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.'
              examples:
                rowLimitExceeded:
                  summary: Result count exceeds the export limit
                  value:
                    message: 'Export limited to 500,000 results. Found 500,001. Please add filters to narrow results.'
        '403':
          description: "The authenticated user does not have the `osquery-read` privilege required to export scheduled query results.\n"
      x-state: Generally available; Added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/osquery/scheduled_results/{scheduleId}/{executionCount}/results':
    get:
      tags:
        - Security Osquery API
      summary: Get scheduled query results
      description: "Get paginated query result rows (the actual osquery output data) for a specific scheduled query execution.\n"
      operationId: OsqueryGetScheduledQueryResults
      parameters:
        - name: scheduleId
          in: path
          description: The schedule ID of the scheduled query.
          required: true
          schema:
            type: string
            description: The schedule ID of the scheduled query.
            example: pack_my_pack_uptime
        - name: executionCount
          in: path
          description: The execution count for this scheduled query run.
          required: true
          schema:
            type: integer
            description: The execution count for this scheduled query run.
            example: 3
        - name: kuery
          in: query
          description: The kuery to filter the results by.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_KueryOrUndefined'
        - name: page
          in: query
          description: The page number to return. The default is 1.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageOrUndefined'
        - name: pageSize
          in: query
          description: The number of results to return per page. The default is 20.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_PageSizeOrUndefined'
        - name: sort
          in: query
          description: The field that is used to sort the results.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrUndefined'
        - name: sortOrder
          in: query
          description: Specifies the sort order.
          schema:
            $ref: '#/components/schemas/Security_Osquery_API_SortOrderOrUndefined'
        - name: startDate
          in: query
          description: The start date filter (ISO 8601) to narrow down results.
          schema:
            type: string
            description: The start date filter (ISO 8601) to narrow down results.
            example: '2024-01-01T00:00:00Z'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Osquery_API_GetScheduledQueryResultsResponse'
              examples:
                scheduledQueryResultsExample:
                  summary: Example scheduled query results response
                  value:
                    data:
                      edges:
                        - _id: row-001
                          fields:
                            host.uptime:
                              - '12345'
                        - _id: row-002
                          fields:
                            host.uptime:
                              - '67890'
                      total: 2
      x-state: Generally available; Added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/pinned_event:
    patch:
      tags:
        - Security Timeline API
      summary: Pin/unpin an event
      description: Pin/unpin an event to/from an existing Timeline.
      operationId: PersistPinnedEventRoute
      requestBody:
        description: 'The pinned event to add or unpin, along with additional metadata.'
        content:
          application/json:
            schema:
              required:
                - eventId
                - timelineId
              type: object
              properties:
                eventId:
                  type: string
                  description: The `_id` of the associated event for this pinned event.
                  example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                pinnedEventId:
                  type:
                    - 'null'
                    - string
                  description: The `savedObjectId` of the pinned event you want to unpin.
                  example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
                timelineId:
                  type: string
                  description: The `savedObjectId` of the timeline that you want this pinned event unpinned from.
                  example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            examples:
              pinEvent:
                summary: Pin an event
                value:
                  eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_PersistPinnedEventResponse'
              examples:
                pinnedSaved:
                  summary: Pinned event saved object
                  value:
                    eventId: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
                    pinnedEventId: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
                    timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    version: WzQ2LDFe
                unpinned:
                  summary: Unpin response
                  value:
                    unpinned: true
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/engine/dangerously_delete_data:
    delete:
      tags:
        - Security Entity Analytics API
      summary: Cleanup the Risk Engine
      description: 'Cleaning up the the Risk Engine by removing the indices, mapping and transforms'
      operationId: CleanUpRiskEngine
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  cleanup_successful:
                    type: boolean
              examples:
                CleanUpRiskEngineResponse:
                  summary: Successful cleanup response
                  value:
                    cleanup_successful: true
        '400':
          description: Task manager is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: 'Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.'
                    status_code: 400
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse'
              examples:
                cleanupFailed:
                  summary: Cleanup failed
                  value:
                    cleanup_successful: false
                    errors:
                      - error: Risk engine is disabled or deleted already.
                        seq: 1
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/engine/saved_object/configure:
    patch:
      tags:
        - Security Entity Analytics API
      summary: Configure the Risk Engine Saved Object
      description: Configuring the Risk Engine Saved Object
      operationId: ConfigureRiskEngineSavedObject
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                enable_reset_to_zero:
                  type: boolean
                exclude_alert_statuses:
                  type: array
                  items:
                    type: string
                exclude_alert_tags:
                  type: array
                  items:
                    type: string
                filters:
                  type: array
                  items:
                    required:
                      - entity_types
                      - filter
                    type: object
                    properties:
                      entity_types:
                        type: array
                        items:
                          enum:
                            - host
                            - user
                            - service
                          type: string
                      filter:
                        type: string
                        description: KQL filter string
                page_size:
                  maximum: 10000
                  minimum: 100
                  type: integer
                  description: "Number of entities to score per page. Higher values reduce total scoring time by reducing the number of alert-index scans, but cannot exceed the ES|QL result limit (10,000 by default).\n"
                range:
                  type: object
                  properties:
                    end:
                      type: string
                    start:
                      type: string
            examples:
              ConfigureRiskEngineSavedObjectRequest:
                summary: Configure the risk engine saved object
                value:
                  enable_reset_to_zero: false
                  exclude_alert_statuses:
                    - closed
                  exclude_alert_tags:
                    - low-priority
                  filters:
                    - entity_types:
                        - host
                        - user
                      filter: 'host.name: *'
                  range:
                    end: now
                    start: now-30d
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                type: object
                properties:
                  risk_engine_saved_object_configured:
                    type: boolean
              examples:
                ConfigureRiskEngineSavedObjectResponse:
                  summary: Successful configuration response
                  value:
                    risk_engine_saved_object_configured: true
        '400':
          description: Task manager is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: 'Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.'
                    status_code: 400
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse'
              examples:
                configureError:
                  summary: Configure saved object failed
                  value:
                    errors:
                      - error: Internal server error
                        seq: 1
                    risk_engine_saved_object_configured: false
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/engine/schedule_now:
    post:
      tags:
        - Security Entity Analytics API
      summary: Run the risk scoring engine
      description: Schedule the risk scoring engine to run as soon as possible. You can use this to recalculate entity risk scores after updating their asset criticality.
      operationId: ScheduleRiskEngineNow
      requestBody:
        content:
          application/json:
            schema:
              type: object
            examples:
              emptyRequest:
                summary: No request body
                value: { }
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowResponse'
              examples:
                ScheduleRiskEngineNowResponse:
                  summary: Successful schedule response
                  value:
                    success: true
        '400':
          description: Task manager is unavailable
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_TaskManagerUnavailableResponse'
              examples:
                taskManagerUnavailable:
                  summary: Task manager is unavailable
                  value:
                    message: 'Task Manager is unavailable, but is required by the risk engine. Please enable the taskManager plugin and try again.'
                    status_code: 400
        default:
          description: Unexpected error
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse'
              examples:
                scheduleNowError:
                  summary: Schedule now failed
                  value:
                    full_error: '{}'
                    message: Internal server error
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/risk_score/history:
    get:
      tags:
        - Security Entity Analytics API
      summary: Get risk score history for an entity
      description: Returns time-ordered historical risk score entries from the risk score time-series index for a given entity.
      operationId: GetRiskScoreHistory
      parameters:
        - name: entity_type
          in: query
          description: The type of entity to retrieve history for.
          required: true
          schema:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_IdentifierType'
        - name: entity_id
          in: query
          description: The identifier of the entity to retrieve history for.
          required: true
          schema:
            maxLength: 1000
            type: string
        - name: from
          in: query
          description: 'Start of the time range, in date-math syntax. Defaults to 90 days ago.'
          schema:
            maxLength: 100
            type: string
            default: now-90d
        - name: to
          in: query
          description: 'End of the time range, in date-math syntax. Defaults to now.'
          schema:
            maxLength: 100
            type: string
            default: now
        - name: score_type
          in: query
          description: 'Filter entries by the type of score recorded (`base`, `propagated`, or `resolution`).'
          schema:
            enum:
              - base
              - propagated
              - resolution
            type: string
        - name: include_contributions
          in: query
          description: 'When true, each entry also includes the contributions recorded for that scoring run (`inputs`, `modifiers`, category 2 fields, and `criticality_level`), when present on the underlying document.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreHistoryResponse'
              examples:
                riskScoreHistory:
                  summary: Risk score history for a user
                  value:
                    entity_id: alice
                    entity_type: user
                    entries:
                      - '@timestamp': '2026-05-20T12:00:00.000Z'
                        calculated_level: High
                        calculated_score: 145.2
                        calculated_score_norm: 72.4
                        category_1_count: 18
                        category_1_score: 102
                        score_type: base
        '400':
          description: Invalid request
      x-state: Added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_create:
    post:
      tags:
        - saved objects
      summary: Create saved objects
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nCreates multiple Kibana saved objects in a single request.\n\nFor transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`)."
      operationId: post-saved-objects-bulk-create
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: overwrite
          in: query
          description: Overwrite existing saved objects that match the same type and ID.
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              maxItems: 10000
              type: array
              items:
                required:
                  - type
                  - attributes
                type: object
                properties:
                  attributes:
                    type: object
                    additionalProperties: { }
                  coreMigrationVersion:
                    maxLength: 256
                    type: string
                  id:
                    maxLength: 512
                    type: string
                  initialNamespaces:
                    maxItems: 100
                    minItems: 1
                    type: array
                    items:
                      maxLength: 512
                      type: string
                  migrationVersion:
                    type: object
                    additionalProperties:
                      maxLength: 256
                      type: string
                  references:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - name
                        - type
                        - id
                      type: object
                      properties:
                        id:
                          maxLength: 512
                          type: string
                        name:
                          maxLength: 1024
                          type: string
                        type:
                          maxLength: 256
                          type: string
                      additionalProperties: false
                  type:
                    maxLength: 256
                    type: string
                  typeMigrationVersion:
                    maxLength: 256
                    type: string
                  version:
                    maxLength: 256
                    type: string
                additionalProperties: false
            examples:
              bulkCreateRequest:
                summary: Create multiple saved objects (partial success)
                value:
                  - attributes:
                      title: Example dashboard 1
                    id: example-dashboard-1
                    references: [ ]
                    type: dashboard
                  - attributes:
                      title: Example dashboard 2
                    id: example-dashboard-2
                    references: [ ]
                    type: dashboard
      responses:
        '200':
          description: A bulk create response.
          content:
            application/json:
              examples:
                bulkCreateResponse:
                  summary: A bulk create response with one conflict
                  value:
                    saved_objects:
                      - attributes:
                          title: Example dashboard 1
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: [ ]
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzEsMV0=
                      - error:
                          error: Conflict
                          message: 'Saved object [dashboard/example-dashboard-2] conflict'
                          statusCode: 409
                        id: example-dashboard-2
                        type: dashboard
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_bulk_create?overwrite=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\",\"attributes\":{\"title\":\"Example dashboard 1\"},\"references\":[]},{\"type\":\"dashboard\",\"id\":\"example-dashboard-2\",\"attributes\":{\"title\":\"Example dashboard 2\"},\"references\":[]}]'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_bulk_create?overwrite=false\n[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\",\"attributes\":{\"title\":\"Example dashboard 1\"},\"references\":[]},{\"type\":\"dashboard\",\"id\":\"example-dashboard-2\",\"attributes\":{\"title\":\"Example dashboard 2\"},\"references\":[]}]\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_delete:
    post:
      tags:
        - saved objects
      summary: Delete saved objects
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nDeletes multiple Kibana saved objects in a single request.\n\nThere is currently no complete replacement for deleting arbitrary saved objects via an HTTP API."
      operationId: post-saved-objects-bulk-delete
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: force
          in: query
          description: 'When true, force deletion of multi-namespace objects from all namespaces.'
          schema:
            type: boolean
      requestBody:
        content:
          application/json:
            schema:
              maxItems: 10000
              type: array
              items:
                required:
                  - type
                  - id
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                additionalProperties: false
            examples:
              bulkDeleteRequest:
                summary: Delete multiple saved objects
                value:
                  - id: example-dashboard-1
                    type: dashboard
                  - id: does-not-exist
                    type: dashboard
      responses:
        '200':
          description: A bulk delete response.
          content:
            application/json:
              examples:
                bulkDeleteResponse:
                  summary: A bulk delete response with one not found result
                  value:
                    statuses:
                      - id: example-dashboard-1
                        success: true
                        type: dashboard
                      - error:
                          error: Not Found
                          message: 'Saved object [dashboard/does-not-exist] not found'
                          statusCode: 404
                        id: does-not-exist
                        success: false
                        type: dashboard
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_bulk_delete?force=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"},{\"type\":\"dashboard\",\"id\":\"does-not-exist\"}]'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_bulk_delete?force=false\n[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"},{\"type\":\"dashboard\",\"id\":\"does-not-exist\"}]\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_get:
    post:
      tags:
        - saved objects
      summary: Get saved objects
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nRetrieves multiple Kibana saved objects by type and ID in a single request.\n\nFor transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`)."
      operationId: post-saved-objects-bulk-get
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              maxItems: 10000
              type: array
              items:
                required:
                  - type
                  - id
                type: object
                properties:
                  fields:
                    maxItems: 100
                    type: array
                    items:
                      maxLength: 1024
                      type: string
                  id:
                    maxLength: 512
                    type: string
                  namespaces:
                    maxItems: 100
                    type: array
                    items:
                      maxLength: 512
                      type: string
                  type:
                    maxLength: 256
                    type: string
                additionalProperties: false
            examples:
              bulkGetRequest:
                summary: Get multiple saved objects
                value:
                  - id: example-dashboard-1
                    type: dashboard
                  - id: does-not-exist
                    type: dashboard
      responses:
        '200':
          description: A bulk get response.
          content:
            application/json:
              examples:
                bulkGetResponse:
                  summary: A bulk get response with one not found result
                  value:
                    saved_objects:
                      - attributes:
                          title: Example dashboard 1
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: [ ]
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzEsMV0=
                      - error:
                          error: Not Found
                          message: 'Saved object [dashboard/does-not-exist] not found'
                          statusCode: 404
                        id: does-not-exist
                        type: dashboard
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_bulk_get\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"},{\"type\":\"dashboard\",\"id\":\"does-not-exist\"}]'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_bulk_get\n[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"},{\"type\":\"dashboard\",\"id\":\"does-not-exist\"}]\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_resolve:
    post:
      tags:
        - saved objects
      summary: Resolve saved objects
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nRetrieve multiple Kibana saved objects by ID, using any legacy URL aliases if they exist.\n\nUnder certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved with the bulk resolve API using either its new ID or its old ID."
      operationId: post-saved-objects-bulk-resolve
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              maxItems: 10000
              type: array
              items:
                required:
                  - type
                  - id
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                additionalProperties: false
            examples:
              bulkResolveRequest:
                summary: Resolve multiple saved objects
                value:
                  - id: example-dashboard-1
                    type: dashboard
                  - id: legacy-id
                    type: dashboard
      responses:
        '200':
          description: A bulk resolve response.
          content:
            application/json:
              examples:
                bulkResolveResponse:
                  summary: A bulk resolve response with an exact and alias match
                  value:
                    resolved_objects:
                      - outcome: exactMatch
                        saved_object:
                          attributes:
                            title: Example dashboard 1
                          id: example-dashboard-1
                          managed: false
                          namespaces:
                            - default
                          references: [ ]
                          type: dashboard
                          updated_at: '2026-04-17T12:00:00.000Z'
                          version: WzEsMV0=
                      - alias_target_id: example-dashboard-2
                        outcome: aliasMatch
                        saved_object:
                          attributes:
                            title: Example dashboard 2
                          id: example-dashboard-2
                          managed: false
                          namespaces:
                            - default
                          references: [ ]
                          type: dashboard
                          updated_at: '2026-04-17T12:00:00.000Z'
                          version: WzEsMl0=
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_bulk_resolve\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"},{\"type\":\"dashboard\",\"id\":\"legacy-id\"}]'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_bulk_resolve\n[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"},{\"type\":\"dashboard\",\"id\":\"legacy-id\"}]\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_bulk_update:
    put:
      tags:
        - saved objects
      summary: Update saved objects
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nUpdates multiple Kibana saved objects in a single request.\n\nFor transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`)."
      operationId: put-saved-objects-bulk-update
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              maxItems: 10000
              type: array
              items:
                required:
                  - type
                  - id
                  - attributes
                type: object
                properties:
                  attributes:
                    type: object
                    additionalProperties: { }
                  id:
                    maxLength: 512
                    type: string
                  namespace:
                    maxLength: 512
                    minLength: 1
                    type: string
                  references:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - name
                        - type
                        - id
                      type: object
                      properties:
                        id:
                          maxLength: 512
                          type: string
                        name:
                          maxLength: 1024
                          type: string
                        type:
                          maxLength: 256
                          type: string
                      additionalProperties: false
                  type:
                    maxLength: 256
                    type: string
                  version:
                    maxLength: 256
                    type: string
                additionalProperties: false
            examples:
              bulkUpdateRequest:
                summary: Update multiple saved objects (partial success)
                value:
                  - attributes:
                      title: Updated dashboard title
                    id: example-dashboard-1
                    references: [ ]
                    type: dashboard
                  - attributes:
                      title: Updated dashboard title
                    id: does-not-exist
                    type: dashboard
      responses:
        '200':
          description: A bulk update response.
          content:
            application/json:
              examples:
                bulkUpdateResponse:
                  summary: A bulk update response with one not found result
                  value:
                    saved_objects:
                      - attributes:
                          title: Updated dashboard title
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: [ ]
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzIsMV0=
                      - error:
                          error: Not Found
                          message: 'Saved object [dashboard/does-not-exist] not found'
                          statusCode: 404
                        id: does-not-exist
                        type: dashboard
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/saved_objects/_bulk_update\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\",\"attributes\":{\"title\":\"Updated dashboard title\"},\"references\":[]},{\"type\":\"dashboard\",\"id\":\"does-not-exist\",\"attributes\":{\"title\":\"Updated dashboard title\"}}]'\n"
        - lang: Console
          source: "PUT kbn://api/saved_objects/_bulk_update\n[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\",\"attributes\":{\"title\":\"Updated dashboard title\"},\"references\":[]},{\"type\":\"dashboard\",\"id\":\"does-not-exist\",\"attributes\":{\"title\":\"Updated dashboard title\"}}]\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_export:
    post:
      tags:
        - saved objects
      summary: Export saved objects
      description: "Retrieve sets of saved objects that you want to import into Kibana. You must include `type` or `objects` in the request body. The output of exporting saved objects must be treated as opaque. Tampering with exported data risks introducing unspecified errors and data loss.\n\nExported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n\nNOTE: The exported saved objects include `coreMigrationVersion` and `typeMigrationVersion` metadata. If you store exported saved objects outside of Kibana (for example in NDJSON files) or generate them yourself, you must preserve or include these fields to retain forward compatibility across Kibana versions.\n\nNOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be exported."
      operationId: post-saved-objects-export
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                excludeExportDetails:
                  type: boolean
                  description: Do not add export details entry at the end of the stream.
                  default: false
                hasReference:
                  anyOf:
                    - required:
                        - type
                        - id
                      type: object
                      properties:
                        id:
                          maxLength: 512
                          type: string
                        type:
                          maxLength: 256
                          type: string
                      additionalProperties: false
                    - maxItems: 100
                      type: array
                      items:
                        required:
                          - type
                          - id
                        type: object
                        properties:
                          id:
                            maxLength: 512
                            type: string
                          type:
                            maxLength: 256
                            type: string
                        additionalProperties: false
                includeReferencesDeep:
                  type: boolean
                  description: Includes all of the referenced objects in the exported objects.
                  default: false
                objects:
                  maxItems: 10000
                  type: array
                  items:
                    required:
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    additionalProperties: false
                  description: 'A list of objects to export. NOTE: this optional parameter cannot be combined with the `types` option'
                search:
                  maxLength: 10000
                  type: string
                  description: Search for documents to export using the Elasticsearch Simple Query String syntax.
                type:
                  anyOf:
                    - maxLength: 256
                      type: string
                    - maxItems: 100
                      type: array
                      items:
                        maxLength: 256
                        type: string
                  description: 'The saved object types to include in the export. Use `*` to export all the types. Valid options depend on enabled plugins, but may include `visualization`, `dashboard`, `search`, `index-pattern`, `tag`, `config`, `config-global`, `lens`, `map`, `event-annotation-group`, `query`, `url`, `action`, `alert`, `alerting_rule_template`, `apm-indices`, `cases-user-actions`, `cases`, `cases-comments`, `infrastructure-monitoring-log-view`, `ml-trained-model`, `osquery-saved-query`, `osquery-pack`, `osquery-pack-asset`.'
              additionalProperties: false
            examples:
              exportSavedObjectsRequest:
                summary: Export a specific saved object
                value:
                  excludeExportDetails: true
                  includeReferencesDeep: false
                  objects:
                    - id: example-dashboard-1
                      type: dashboard
      responses:
        '200':
          description: Indicates a successfull call.
          content:
            application/x-ndjson:
              schema: { }
              examples:
                exportSavedObjectsResponse:
                  summary: The export response contains an NDJSON record for each exported object
                  value: "{\"id\":\"example-dashboard-1\",\"type\":\"dashboard\",\"attributes\":{\"title\":\"Example dashboard 1\"},\"references\":[],\"managed\":false}\n{\"exportedCount\":1,\"missingRefCount\":0,\"missingReferences\":[]}\n"
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                required:
                  - error
                  - message
                  - statusCode
                type: object
                properties:
                  error:
                    type: string
                  message:
                    type: string
                  statusCode:
                    enum:
                      - 400
                    type: integer
                additionalProperties: false
                description: Indicates an unsuccessful response.
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Either `type` or `objects` are required.: Bad Request'
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_export\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"objects\":[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"}],\"includeReferencesDeep\":false,\"excludeExportDetails\":true}'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_export\n{\"objects\":[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\"}],\"includeReferencesDeep\":false,\"excludeExportDetails\":true}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_find:
    get:
      tags:
        - saved objects
      summary: Search for saved objects
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nSearches for Kibana saved objects.\n\nFor transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`)."
      operationId: get-saved-objects-find
      parameters:
        - name: per_page
          in: query
          description: The number of items per page.
          schema:
            minimum: 0
            type: number
            default: 20
        - name: page
          in: query
          description: The page index to return.
          schema:
            minimum: 0
            type: number
            default: 1
        - name: type
          in: query
          description: The saved object type or types to search for. Use multiple `type` values to search across types.
          required: true
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 256
              type: string
        - name: search
          in: query
          description: A text search string.
          schema:
            maxLength: 10000
            type: string
        - name: default_search_operator
          in: query
          description: The boolean operator to use when combining multiple values.
          schema:
            enum:
              - OR
              - AND
            type: string
            default: OR
        - name: search_fields
          in: query
          description: The fields to search on.
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 1024
              type: string
        - name: sort_field
          in: query
          description: The field to sort on.
          schema:
            maxLength: 1024
            type: string
        - name: has_reference
          in: query
          description: Return only saved objects that have a reference to the specified saved object(s).
          schema:
            anyOf:
              - required:
                  - type
                  - id
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                additionalProperties: false
              - maxItems: 100
                type: array
                items:
                  required:
                    - type
                    - id
                  type: object
                  properties:
                    id:
                      maxLength: 512
                      type: string
                    type:
                      maxLength: 256
                      type: string
                  additionalProperties: false
        - name: has_reference_operator
          in: query
          description: The boolean operator to use when combining multiple values.
          schema:
            enum:
              - OR
              - AND
            type: string
            default: OR
        - name: has_no_reference
          in: query
          description: Return only saved objects that do not have a reference to the specified saved object(s).
          schema:
            anyOf:
              - required:
                  - type
                  - id
                type: object
                properties:
                  id:
                    maxLength: 512
                    type: string
                  type:
                    maxLength: 256
                    type: string
                additionalProperties: false
              - maxItems: 100
                type: array
                items:
                  required:
                    - type
                    - id
                  type: object
                  properties:
                    id:
                      maxLength: 512
                      type: string
                    type:
                      maxLength: 256
                      type: string
                  additionalProperties: false
        - name: has_no_reference_operator
          in: query
          description: The boolean operator to use when combining multiple values.
          schema:
            enum:
              - OR
              - AND
            type: string
            default: OR
        - name: fields
          in: query
          description: The fields to return for each saved object.
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 1024
              type: string
        - name: filter
          in: query
          description: A KQL filter to apply to the search.
          schema:
            maxLength: 10000
            type: string
        - name: aggs
          in: query
          description: Aggregations as a JSON string.
          schema:
            maxLength: 100000
            type: string
        - name: namespaces
          in: query
          description: The namespaces (spaces) to search in.
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 512
              type: string
      responses:
        '200':
          description: A search response.
          content:
            application/json:
              examples:
                findSavedObjectsResponse:
                  summary: A page of saved objects
                  value:
                    page: 1
                    per_page: 20
                    saved_objects:
                      - attributes:
                          title: Example dashboard 1
                        id: example-dashboard-1
                        managed: false
                        namespaces:
                          - default
                        references: [ ]
                        type: dashboard
                        updated_at: '2026-04-17T12:00:00.000Z'
                        version: WzEsMV0=
                    total: 1
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'This type dashboard is not allowed: Bad Request'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/saved_objects/_find?type=dashboard&fields=title&per_page=20&page=1\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/saved_objects/_find?type=dashboard&fields=title&per_page=20&page=1\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_import:
    post:
      tags:
        - saved objects
      summary: Import saved objects
      description: "Create sets of Kibana saved objects from a file created by the export API. Saved objects can only be imported into the same version, a newer minor on the same major, or the next major. Tampering with exported data risks introducing unspecified errors and data loss.\n\nExported saved objects are not backwards compatible and cannot be imported into an older version of Kibana.\n\nNOTE: The exported saved objects include `coreMigrationVersion` and `typeMigrationVersion` metadata. If you store exported saved objects outside of Kibana (for example in NDJSON files) or generate them yourself, you must preserve or include these fields to retain forwards compatibility across Kibana versions."
      operationId: post-saved-objects-import
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: overwrite
          in: query
          description: 'Overwrites saved objects when they already exist. When used, potential conflict errors are automatically resolved by overwriting the destination object. NOTE: This option cannot be used with the `createNewCopies` option.'
          schema:
            type: boolean
            default: false
        - name: createNewCopies
          in: query
          description: 'Creates copies of saved objects, regenerates each object ID, and resets the origin. When used, potential conflict errors are avoided. NOTE: This option cannot be used with the `overwrite` and `compatibilityMode` options.'
          schema:
            type: boolean
            default: false
        - name: compatibilityMode
          in: query
          description: 'Applies various adjustments to the saved objects that are being imported to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with imported saved objects. NOTE: This option cannot be used with the `createNewCopies` option.'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          multipart/form-data:
            schema:
              required:
                - file
              type: object
              properties:
                file:
                  type: object
                  description: 'A file exported using the export API. Changing the contents of the exported file in any way before importing it can cause errors, crashes or data loss. NOTE: The `savedObjects.maxImportExportSize` configuration setting limits the number of saved objects which may be included in this file. Similarly, the `savedObjects.maxImportPayloadBytes` setting limits the overall size of the file that can be imported.'
              additionalProperties: false
            examples:
              importObjectsRequest:
                summary: Import saved objects from an NDJSON file
                value:
                  file: file.ndjson
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - success
                  - successCount
                  - errors
                  - successResults
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      type: object
                    description: "Indicates the import was unsuccessful and specifies the objects that failed to import.\n\nNOTE: One object may result in multiple errors, which requires separate steps to resolve. For instance, a `missing_references` error and conflict error."
                  success:
                    type: boolean
                    description: 'Indicates when the import was successfully completed. When set to false, some objects may not have been created. For additional information, refer to the `errors` and `successResults` properties.'
                  successCount:
                    type: number
                    description: Indicates the number of successfully imported records.
                  successResults:
                    type: array
                    items:
                      type: object
                    description: "Indicates the objects that are successfully imported, with any metadata if applicable.\n\nNOTE: Objects are created only when all resolvable errors are addressed, including conflicts and missing references. If objects are created as new copies, each entry in the `successResults` array includes a `destinationId` attribute."
                additionalProperties: false
              examples:
                importObjectsResponse:
                  summary: A successful import response
                  value:
                    errors: [ ]
                    success: true
                    successCount: 1
                    successResults:
                      - destinationId: example-dashboard-1-copy
                        id: example-dashboard-1
                        managed: false
                        type: dashboard
        '400':
          description: Bad request.
          content:
            application/json:
              schema:
                required:
                  - error
                  - message
                  - statusCode
                type: object
                properties:
                  error:
                    type: string
                  message:
                    type: string
                  statusCode:
                    enum:
                      - 400
                    type: integer
                additionalProperties: false
                description: Indicates an unsuccessful response.
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: Invalid file extension .txt
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_import?createNewCopies=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  --form file=@file.ndjson\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_import?createNewCopies=true\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/saved_objects/_resolve_import_errors:
    post:
      tags:
        - saved objects
      summary: Resolve import errors
      description: 'To resolve errors from the import objects API, you can retry certain saved objects, overwrite specific saved objects, and change references to different saved objects'
      operationId: post-saved-objects-resolve-import-errors
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: createNewCopies
          in: query
          description: 'Creates copies of saved objects, regenerates each object ID, and resets the origin.'
          schema:
            type: boolean
            default: false
        - name: compatibilityMode
          in: query
          description: Applies adjustments to maintain compatibility between different Kibana versions.
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          multipart/form-data:
            schema:
              required:
                - file
                - retries
              type: object
              properties:
                file:
                  type: object
                retries:
                  maxItems: 10000
                  type: array
                  items:
                    required:
                      - type
                      - id
                    type: object
                    properties:
                      createNewCopy:
                        type: boolean
                      destinationId:
                        maxLength: 512
                        type: string
                      id:
                        maxLength: 512
                        type: string
                      ignoreMissingReferences:
                        type: boolean
                      overwrite:
                        type: boolean
                        default: false
                      replaceReferences:
                        maxItems: 100
                        type: array
                        items:
                          required:
                            - type
                            - from
                            - to
                          type: object
                          properties:
                            from:
                              maxLength: 512
                              type: string
                            to:
                              maxLength: 512
                              type: string
                            type:
                              maxLength: 256
                              type: string
                          additionalProperties: false
                        default: [ ]
                      type:
                        maxLength: 256
                        type: string
                    additionalProperties: false
              additionalProperties: false
            examples:
              resolveImportErrorsRequest:
                summary: Resolve import errors by retrying objects
                value:
                  file: file.ndjson
                  retries:
                    - id: example-dashboard-1
                      overwrite: true
                      replaceReferences: [ ]
                      type: dashboard
      responses:
        '200':
          description: A successful resolve import errors response.
          content:
            application/json:
              examples:
                resolveImportErrorsResponse:
                  summary: A successful resolve import errors response
                  value:
                    errors: [ ]
                    success: true
                    successCount: 1
                    successResults:
                      - id: example-dashboard-1
                        managed: false
                        type: dashboard
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: Invalid file extension .txt
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/_resolve_import_errors\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  --form file=@file.ndjson \\\n  --form retries='[{\"type\":\"dashboard\",\"id\":\"example-dashboard-1\",\"overwrite\":true,\"replaceReferences\":[]}]'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/_resolve_import_errors\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/saved_objects/{type}':
    post:
      tags:
        - saved objects
      summary: Create a saved object
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nCreates a Kibana saved object; if an ID is provided it is used, otherwise Kibana generates one.\n\nFor transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`)."
      operationId: post-saved-objects-type
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: type
          in: path
          description: The saved object type.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: overwrite
          in: query
          description: Overwrite an existing saved object.
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              required:
                - attributes
              type: object
              properties:
                attributes:
                  type: object
                  additionalProperties: { }
                coreMigrationVersion:
                  maxLength: 256
                  type: string
                initialNamespaces:
                  maxItems: 100
                  minItems: 1
                  type: array
                  items:
                    maxLength: 512
                    type: string
                migrationVersion:
                  type: object
                  additionalProperties:
                    maxLength: 256
                    type: string
                references:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - name
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      name:
                        maxLength: 1024
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    additionalProperties: false
                typeMigrationVersion:
                  maxLength: 256
                  type: string
              additionalProperties: false
            examples:
              createDashboardRequest:
                summary: Create a dashboard saved object
                value:
                  attributes:
                    title: Example dashboard
                  references: [ ]
      responses:
        '200':
          description: A successful create response.
          content:
            application/json:
              examples:
                createDashboardResponse:
                  summary: A created saved object
                  value:
                    attributes:
                      title: Example dashboard
                    id: example-dashboard-id
                    managed: false
                    namespaces:
                      - default
                    references: [ ]
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzEsMV0=
        '409':
          description: A conflict error.
          content:
            application/json:
              examples:
                conflictResponse:
                  summary: A conflict error
                  value:
                    error: Conflict
                    message: 'Saved object [dashboard/example-dashboard-id] conflict'
                    statusCode: 409
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-id?overwrite=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"attributes\":{\"title\":\"Example dashboard\"},\"references\":[]}'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/dashboard/example-dashboard-id?overwrite=false\n{\"attributes\":{\"title\":\"Example dashboard\"},\"references\":[]}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/saved_objects/{type}/{id}':
    delete:
      tags:
        - saved objects
      summary: Delete a saved object
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nDeletes a single Kibana saved object by type and ID.\n\nThere is currently no complete replacement for deleting arbitrary saved objects via an HTTP API."
      operationId: delete-saved-objects-type-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: type
          in: path
          description: The saved object type.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: id
          in: path
          description: The saved object identifier.
          required: true
          schema:
            maxLength: 512
            type: string
        - name: force
          in: query
          description: 'When true, force deletion of multi-namespace objects from all namespaces.'
          schema:
            type: boolean
      responses:
        '200':
          description: A successful delete response.
          content:
            application/json:
              examples:
                deleteSavedObjectResponse:
                  summary: Successful delete
                  value: { }
        '404':
          description: Not found.
          content:
            application/json:
              examples:
                notFoundResponse:
                  summary: A not found error
                  value:
                    error: Not Found
                    message: 'Saved object [dashboard/does-not-exist] not found'
                    statusCode: 404
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-1?force=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/saved_objects/dashboard/example-dashboard-1?force=false\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - saved objects
      summary: Get a saved object
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nRetrieves a single Kibana saved object by type and ID.\n\nFor transferring or backing up saved objects, prefer the export API (`POST /api/saved_objects/_export`)."
      operationId: get-saved-objects-type-id
      parameters:
        - name: type
          in: path
          description: The saved object type.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: id
          in: path
          description: The saved object identifier.
          required: true
          schema:
            maxLength: 512
            type: string
      responses:
        '200':
          description: A saved object.
          content:
            application/json:
              examples:
                getSavedObjectResponse:
                  summary: A saved object
                  value:
                    attributes:
                      title: Example dashboard 1
                    id: example-dashboard-1
                    managed: false
                    namespaces:
                      - default
                    references: [ ]
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzEsMV0=
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-1\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/saved_objects/dashboard/example-dashboard-1\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - saved objects
      summary: Create a saved object
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nCreates a Kibana saved object; if an ID is provided it is used, otherwise Kibana generates one.\n\nFor transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`)."
      operationId: post-saved-objects-type-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: type
          in: path
          description: The saved object type.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: id
          in: path
          description: The saved object identifier.
          required: true
          schema:
            maxLength: 512
            type: string
        - name: overwrite
          in: query
          description: Overwrite an existing saved object.
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              required:
                - attributes
              type: object
              properties:
                attributes:
                  type: object
                  additionalProperties: { }
                coreMigrationVersion:
                  maxLength: 256
                  type: string
                initialNamespaces:
                  maxItems: 100
                  minItems: 1
                  type: array
                  items:
                    maxLength: 512
                    type: string
                migrationVersion:
                  type: object
                  additionalProperties:
                    maxLength: 256
                    type: string
                references:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - name
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      name:
                        maxLength: 1024
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    additionalProperties: false
                typeMigrationVersion:
                  maxLength: 256
                  type: string
              additionalProperties: false
            examples:
              createDashboardRequest:
                summary: Create a dashboard saved object
                value:
                  attributes:
                    title: Example dashboard
                  references: [ ]
      responses:
        '200':
          description: A successful create response.
          content:
            application/json:
              examples:
                createDashboardResponse:
                  summary: A created saved object
                  value:
                    attributes:
                      title: Example dashboard
                    id: example-dashboard-id
                    managed: false
                    namespaces:
                      - default
                    references: [ ]
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzEsMV0=
        '409':
          description: A conflict error.
          content:
            application/json:
              examples:
                conflictResponse:
                  summary: A conflict error
                  value:
                    error: Conflict
                    message: 'Saved object [dashboard/example-dashboard-id] conflict'
                    statusCode: 409
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-id?overwrite=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"attributes\":{\"title\":\"Example dashboard\"},\"references\":[]}'\n"
        - lang: Console
          source: "POST kbn://api/saved_objects/dashboard/example-dashboard-id?overwrite=false\n{\"attributes\":{\"title\":\"Example dashboard\"},\"references\":[]}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - saved objects
      summary: Update a saved object
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nUpdates a single Kibana saved object by type and ID.\n\nFor transferring or backing up saved objects, prefer the import and export APIs (`POST /api/saved_objects/_import` and `POST /api/saved_objects/_export`)."
      operationId: put-saved-objects-type-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: type
          in: path
          description: The saved object type.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: id
          in: path
          description: The saved object identifier.
          required: true
          schema:
            maxLength: 512
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - attributes
              type: object
              properties:
                attributes:
                  type: object
                  additionalProperties: { }
                references:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - name
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        maxLength: 512
                        type: string
                      name:
                        maxLength: 1024
                        type: string
                      type:
                        maxLength: 256
                        type: string
                    additionalProperties: false
                upsert:
                  type: object
                  additionalProperties: { }
                version:
                  maxLength: 256
                  type: string
              additionalProperties: false
            examples:
              updateDashboardRequest:
                summary: Update a dashboard saved object
                value:
                  attributes:
                    title: Updated dashboard title
                  references: [ ]
      responses:
        '200':
          description: A successful update response.
          content:
            application/json:
              examples:
                updateDashboardResponse:
                  summary: An updated saved object
                  value:
                    attributes:
                      title: Updated dashboard title
                    id: example-dashboard-1
                    managed: false
                    namespaces:
                      - default
                    references: [ ]
                    type: dashboard
                    updated_at: '2026-04-17T12:00:00.000Z'
                    version: WzIsMV0=
        '404':
          description: Not found.
          content:
            application/json:
              examples:
                notFoundResponse:
                  summary: A not found error
                  value:
                    error: Not Found
                    message: 'Saved object [dashboard/does-not-exist] not found'
                    statusCode: 404
        '409':
          description: A conflict error.
          content:
            application/json:
              examples:
                conflictResponse:
                  summary: A conflict error
                  value:
                    error: Conflict
                    message: 'Saved object [dashboard/example-dashboard-1] conflict'
                    statusCode: 409
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/saved_objects/dashboard/example-dashboard-1\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"attributes\":{\"title\":\"Updated dashboard title\"},\"references\":[]}'\n"
        - lang: Console
          source: "PUT kbn://api/saved_objects/dashboard/example-dashboard-1\n{\"attributes\":{\"title\":\"Updated dashboard title\"},\"references\":[]}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/saved_objects/resolve/{type}/{id}':
    get:
      tags:
        - saved objects
      summary: Resolve a saved object
      description: "WARNING: This API is deprecated. This is a legacy Saved Objects API and may be removed in a future version of Kibana.\n\nRetrieve a single Kibana saved object by ID, using any legacy URL alias if it exists.\n\nUnder certain circumstances, when Kibana is upgraded, saved object migrations may necessitate regenerating some object IDs to enable new features. When an object's ID is regenerated, a legacy URL alias is created for that object, preserving its old ID. In such a scenario, that object can be retrieved with the resolve API using either its new ID or its old ID."
      operationId: get-saved-objects-resolve-type-id
      parameters:
        - name: type
          in: path
          description: The saved object type.
          required: true
          schema:
            maxLength: 256
            type: string
        - name: id
          in: path
          description: The saved object identifier.
          required: true
          schema:
            maxLength: 512
            type: string
      responses:
        '200':
          description: A resolve response.
          content:
            application/json:
              examples:
                resolveSavedObjectResponse:
                  summary: A resolved saved object (alias match)
                  value:
                    alias_target_id: example-dashboard-2
                    outcome: aliasMatch
                    saved_object:
                      attributes:
                        title: Example dashboard 2
                      id: example-dashboard-2
                      managed: false
                      namespaces:
                        - default
                      references: [ ]
                      type: dashboard
                      updated_at: '2026-04-17T12:00:00.000Z'
                      version: WzEsMl0=
        '400':
          description: A bad request.
          content:
            application/json:
              examples:
                badRequestResponse:
                  summary: A bad request error
                  value:
                    error: Bad Request
                    message: 'Unsupported saved object type(s): unknownType'
                    statusCode: 400
      deprecated: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/saved_objects/resolve/dashboard/legacy-id\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/saved_objects/resolve/dashboard/legacy-id\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/anonymization_fields/_bulk_action:
    post:
      tags:
        - Security AI Assistant API
      summary: Apply a bulk action to anonymization fields
      description: Apply a bulk action to multiple anonymization fields. The bulk action is applied to all anonymization fields that match the filter or to the list of anonymization fields by their IDs.
      operationId: PerformAnonymizationFieldsBulkAction
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                create:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldCreateProps'
                  description: Array of anonymization fields to create.
                delete:
                  type: object
                  properties:
                    ids:
                      minItems: 1
                      type: array
                      items:
                        type: string
                      description: Array of IDs to apply the action to.
                      example:
                        - '1234'
                        - '5678'
                    query:
                      type: string
                      description: Query to filter the bulk action.
                      example: 'status: ''inactive'''
                  description: Object containing the query to filter anonymization fields and/or an array of anonymization field IDs to delete.
                update:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldUpdateProps'
                  description: Array of anonymization fields to update.
              example:
                create:
                  - allowed: true
                    anonymized: false
                    field: host.name
                  - allowed: false
                    anonymized: true
                    field: user.name
                delete:
                  ids:
                    - field5
                    - field6
                  query: 'field: host.name'
                update:
                  - allowed: true
                    anonymized: false
                    id: field8
                  - allowed: false
                    anonymized: true
                    id: field9
            examples:
              PerformAnonymizationFieldsBulkActionRequest:
                value:
                  create:
                    - allowed: true
                      anonymized: false
                      field: host.name
                    - allowed: false
                      anonymized: true
                      field: user.name
                  delete:
                    ids:
                      - field5
                      - field6
                    query: 'field: host.name'
                  update:
                    - allowed: true
                      anonymized: false
                      id: field8
                    - allowed: false
                      anonymized: true
                      id: field9
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse'
              examples:
                PerformAnonymizationFieldsBulkActionResponse200Example:
                  value:
                    anonymization_fields_count: 4
                    attributes:
                      results:
                        created:
                          - allowed: false
                            anonymized: true
                            createdAt: '2023-10-31T12:00:00Z'
                            createdBy: user1
                            field: host.name
                            id: field2
                            namespace: default
                            timestamp: '2023-10-31T12:00:00Z'
                            updatedAt: '2023-10-31T12:00:00Z'
                            updatedBy: user1
                        deleted:
                          - field3
                        skipped:
                          - id: field4
                            name: user.name
                            skip_reason: ANONYMIZATION_FIELD_NOT_MODIFIED
                        updated:
                          - allowed: true
                            anonymized: false
                            createdAt: '2023-10-31T12:00:00Z'
                            createdBy: user1
                            field: url.domain
                            id: field8
                            namespace: default
                            timestamp: '2023-10-31T12:00:00Z'
                            updatedAt: '2023-10-31T12:00:00Z'
                            updatedBy: user1
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 3
                        total: 4
                    message: Bulk action completed successfully
                    status_code: 200
                    success: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error type or name.
                  message:
                    type: string
                    description: Detailed error message.
                  statusCode:
                    type: number
                    description: Status code of the response.
              examples:
                PerformAnonymizationFieldsBulkActionResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request body
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/anonymization_fields/_bulk_action' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"create\":[{\"field\":\"host.name\",\"allowed\":true,\"anonymized\":false}]}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/anonymization_fields/_find:
    get:
      tags:
        - Security AI Assistant API
      summary: Get anonymization fields
      description: Get a list of all anonymization fields.
      operationId: FindAnonymizationFields
      parameters:
        - name: fields
          in: query
          description: Fields to return
          schema:
            type: array
            items:
              type: string
          example:
            - id
            - field
            - anonymized
            - allowed
        - name: filter
          in: query
          description: Search query
          schema:
            type: string
          example: 'field: "user.name"'
        - name: sort_field
          in: query
          description: Field to sort by
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindAnonymizationFieldsSortField'
          example: created_at
        - name: sort_order
          in: query
          description: Sort order
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
          example: asc
        - name: page
          in: query
          description: Page number
          schema:
            minimum: 1
            type: integer
            default: 1
          example: 1
        - name: per_page
          in: query
          description: AnonymizationFields per page
          schema:
            minimum: 0
            type: integer
            default: 20
          example: 20
        - name: all_data
          in: query
          description: 'If true, additionally fetch all anonymization fields, otherwise fetch only the provided page'
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - page
                  - perPage
                  - total
                  - data
                type: object
                properties:
                  aggregations:
                    type: object
                    properties:
                      field_status:
                        type: object
                        properties:
                          buckets:
                            type: object
                            properties:
                              allowed:
                                type: object
                                properties:
                                  doc_count:
                                    type: integer
                                    default: 0
                              anonymized:
                                type: object
                                properties:
                                  doc_count:
                                    type: integer
                                    default: 0
                              denied:
                                type: object
                                properties:
                                  doc_count:
                                    type: integer
                                    default: 0
                  all:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
                  page:
                    type: integer
                  perPage:
                    type: integer
                  total:
                    type: integer
              examples:
                FindAnonymizationFieldsResponse200Example:
                  value:
                    aggregations:
                      field_status:
                        buckets:
                          allowed:
                            doc_count: 1
                          anonymized:
                            doc_count: 1
                          denied:
                            doc_count: 1
                    all:
                      - allowed: true
                        anonymized: true
                        createdAt: '2023-10-31T12:00:00Z'
                        createdBy: user1
                        field: user.name
                        id: '1'
                        namespace: default
                        timestamp: '2023-10-31T12:00:00Z'
                        updatedAt: '2023-10-31T12:00:00Z'
                        updatedBy: user1
                    data:
                      - allowed: true
                        anonymized: true
                        createdAt: '2023-10-31T12:00:00Z'
                        createdBy: user1
                        field: user.name
                        id: '1'
                        namespace: default
                        timestamp: '2023-10-31T12:00:00Z'
                        updatedAt: '2023-10-31T12:00:00Z'
                        updatedBy: user1
                    page: 1
                    perPage: 20
                    total: 100
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                  message:
                    type: string
                  statusCode:
                    type: number
              examples:
                FindAnonymizationFieldsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request parameters
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/anonymization_fields/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/chat/complete:
    post:
      tags:
        - Security AI Assistant API
      summary: Create a model response
      description: Create a model response for the given chat conversation.
      operationId: ChatComplete
      parameters:
        - name: content_references_disabled
          in: query
          description: 'If true, the response will not include content references.'
          schema:
            type: boolean
            default: false
          example: false
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_ChatCompleteProps'
            examples:
              ChatCompleteRequest:
                value:
                  connectorId: conn-001
                  conversationId: abc123
                  isStream: true
                  langSmithApiKey: <LANGSMITH_API_KEY>
                  langSmithProject: security_ai_project
                  messages:
                    - content: What are some common phishing techniques?
                      data:
                        user_id: user_789
                      fields_to_anonymize:
                        - user.name
                        - source.ip
                      role: user
                  model: gpt-4
                  persist: true
                  promptId: prompt_456
                  responseLanguage: en
        required: true
      responses:
        '200':
          description: Indicates a successful model response call.
          content:
            application/octet-stream:
              schema:
                type: string
                format: binary
              examples:
                ChatCompleteResponse200Example:
                  value: (streaming binary response)
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Error type.
                    example: Bad Request
                  message:
                    type: string
                    description: Human-readable error message.
                    example: Invalid request payload.
                  statusCode:
                    type: number
                    description: HTTP status code.
                    example: 400
              examples:
                ChatCompleteResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request payload.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/chat/complete' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"connectorId\":\"conn-001\",\"persist\":true,\"messages\":[{\"role\":\"user\",\"content\":\"What are common phishing techniques?\"}]}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/current_user/conversations:
    delete:
      tags:
        - Security AI Assistant API
      summary: Delete conversations
      description: This endpoint allows users to permanently delete all conversations.
      operationId: DeleteAllConversations
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                excludedIds:
                  type: array
                  items:
                    type: string
                  description: Optional list of conversation IDs to delete.
                  example:
                    - abc123
                    - def456
            examples:
              DeleteAllConversationsRequest:
                value:
                  excludedIds:
                    - abc123
                    - def456
      responses:
        '200':
          description: Indicates a successful call. The conversations were deleted successfully.
          content:
            application/json:
              schema:
                type: object
                properties:
                  failures:
                    type: array
                    items:
                      type: string
                  success:
                    type: boolean
                    example: true
                  totalDeleted:
                    type: number
                    example: 10
              examples:
                DeleteAllConversationsResponse200Example:
                  value:
                    failures: [ ]
                    success: true
                    totalDeleted: 10
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: Invalid conversation ID
                  statusCode:
                    type: number
                    example: 400
              examples:
                DeleteAllConversationsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid conversation ID
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"excludedIds\":[\"abc123\"]}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security AI Assistant API
      summary: Create a conversation
      description: Create a new Security AI Assistant conversation. This endpoint allows the user to initiate a conversation with the Security AI Assistant by providing the required parameters.
      operationId: CreateConversation
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCreateProps'
            examples:
              CreateConversationRequest:
                value:
                  apiConfig:
                    actionTypeId: '67890'
                    connectorId: '12345'
                  category: assistant
                  excludeFromLastConversationStorage: false
                  messages:
                    - content: 'Hello, how can I assist you today?'
                      role: system
                      timestamp: '2023-10-31T12:00:00Z'
                  replacements: { }
                  title: Security Discussion
        required: true
      responses:
        '200':
          description: Indicates a successful call. The conversation was created successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
              examples:
                CreateConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '67890'
                      connectorId: '12345'
                    category: assistant
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: false
                    id: abc123
                    messages:
                      - content: 'Hello, how can I assist you today?'
                        role: system
                        timestamp: '2023-10-31T12:00:00Z'
                    namespace: default
                    replacements: { }
                    title: Security Discussion
                    updatedAt: '2023-10-31T12:01:00Z'
                    users:
                      - id: user1
                        name: John Doe
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: 'Missing required parameter: title'
                  statusCode:
                    type: number
                    example: 400
              examples:
                CreateConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: 'Missing required parameter: title'
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/current_user/conversations' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"title\":\"Security Discussion\",\"category\":\"assistant\",\"messages\":[{\"content\":\"Hello\",\"role\":\"system\",\"timestamp\":\"2023-10-31T12:00:00Z\"}],\"apiConfig\":{\"connectorId\":\"12345\",\"actionTypeId\":\"67890\"},\"replacements\":{},\"excludeFromLastConversationStorage\":false}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/current_user/conversations/_find:
    get:
      tags:
        - Security AI Assistant API
      summary: Get conversations
      description: 'Get a list of all conversations for the current user. This endpoint allows users to search, filter, sort, and paginate through their conversations.'
      operationId: FindConversations
      parameters:
        - name: fields
          in: query
          description: 'A list of fields to include in the response. If omitted, all fields are returned.'
          schema:
            type: array
            items:
              type: string
            example:
              - id
              - title
              - createdAt
        - name: filter
          in: query
          description: 'A search query to filter the conversations. Can match against titles, messages, or other conversation attributes.'
          schema:
            type: string
            example: Security Issue
        - name: sort_field
          in: query
          description: 'The field by which to sort the results. Valid fields are `created_at`, `title`, and `updated_at`.'
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindConversationsSortField'
        - name: sort_order
          in: query
          description: The order in which to sort the results. Can be either `asc` for ascending or `desc` for descending.
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
        - name: page
          in: query
          description: The page number of the results to retrieve. Default is 1.
          schema:
            minimum: 1
            type: integer
            default: 1
            example: 1
        - name: per_page
          in: query
          description: The number of conversations to return per page. Default is 20.
          schema:
            minimum: 0
            type: integer
            default: 20
            example: 20
        - name: is_owner
          in: query
          description: 'Whether to return conversations that the current user owns. If true, only conversations owned by the user are returned.'
          schema:
            type: boolean
            default: false
            example: true
      responses:
        '200':
          description: 'Successful response, returns a paginated list of conversations matching the specified criteria.'
          content:
            application/json:
              schema:
                required:
                  - page
                  - perPage
                  - total
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
                    description: A list of conversations.
                  page:
                    type: integer
                    description: The current page of the results.
                    example: 1
                  perPage:
                    type: integer
                    description: The number of results returned per page.
                    example: 20
                  total:
                    type: integer
                    description: The total number of conversations matching the filter criteria.
                    example: 100
              examples:
                FindConversationsResponse200Example:
                  value:
                    data:
                      - category: assistant
                        createdAt: '2023-10-31T12:00:00Z'
                        createdBy:
                          id: user1
                          name: John Doe
                        excludeFromLastConversationStorage: false
                        id: conv-abc123
                        messages: [ ]
                        namespace: default
                        replacements: { }
                        title: Security Discussion
                        updatedAt: '2023-10-31T12:05:00Z'
                        users:
                          - id: user1
                            name: John Doe
                    page: 1
                    perPage: 20
                    total: 5
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: Invalid filter query parameter
                  statusCode:
                    type: number
                    example: 400
              examples:
                FindConversationsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid filter parameter.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security_ai_assistant/current_user/conversations/{id}':
    delete:
      tags:
        - Security AI Assistant API
      summary: Delete a conversation
      description: Delete an existing conversation using the conversation ID. This endpoint allows users to permanently delete a conversation.
      operationId: DeleteConversation
      parameters:
        - name: id
          in: path
          description: The conversation's `id` value.
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
          example: abc123
      responses:
        '200':
          description: Indicates a successful call. The conversation was deleted successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
              examples:
                DeleteConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '67890'
                      connectorId: '12345'
                    category: assistant
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: false
                    id: abc123
                    messages:
                      - content: The conversation has been deleted.
                        role: system
                        timestamp: '2023-10-31T12:35:00Z'
                    namespace: default
                    replacements: { }
                    title: Deleted Security Discussion
                    updatedAt: '2023-10-31T12:01:00Z'
                    users:
                      - id: user1
                        name: John Doe
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: Invalid conversation ID
                  statusCode:
                    type: number
                    example: 400
              examples:
                DeleteConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid conversation ID
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security AI Assistant API
      summary: Get a conversation
      description: Get the details of an existing conversation using the conversation ID. This allows users to fetch the specific conversation data by its unique ID.
      operationId: ReadConversation
      parameters:
        - name: id
          in: path
          description: 'The conversation''s `id` value, a unique identifier for the conversation.'
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
          example: abc123
      responses:
        '200':
          description: Indicates a successful call. The conversation details are returned.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
              examples:
                ReadConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '67890'
                      connectorId: '12345'
                    category: assistant
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: false
                    id: abc123
                    messages:
                      - content: 'Hello, how can I assist you today?'
                        role: system
                        timestamp: '2023-10-31T12:00:00Z'
                    namespace: default
                    replacements: { }
                    title: Security Discussion
                    updatedAt: '2023-10-31T12:01:00Z'
                    users:
                      - id: user1
                        name: John Doe
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: Invalid conversation ID
                  statusCode:
                    type: number
                    example: 400
              examples:
                ReadConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid conversation ID
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security AI Assistant API
      summary: Update a conversation
      description: Update an existing conversation using the conversation ID. This endpoint allows users to modify the details of an existing conversation.
      operationId: UpdateConversation
      parameters:
        - name: id
          in: path
          description: The conversation's `id` value.
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
          example: abc123
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationUpdateProps'
            examples:
              UpdateConversationRequest:
                value:
                  apiConfig:
                    actionTypeId: '09876'
                    connectorId: '54321'
                  category: insights
                  excludeFromLastConversationStorage: true
                  messages:
                    - content: The issue was resolved.
                      role: assistant
                      timestamp: '2023-10-31T12:30:00Z'
                  replacements: { }
                  title: Updated Security Discussion
        required: true
      responses:
        '200':
          description: Indicates a successful call. The conversation was updated successfully.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationResponse'
              examples:
                UpdateConversationResponse200Example:
                  value:
                    apiConfig:
                      actionTypeId: '09876'
                      connectorId: '54321'
                    category: insights
                    createdAt: '2023-10-31T12:01:00Z'
                    createdBy:
                      id: user1
                      name: John Doe
                    excludeFromLastConversationStorage: true
                    id: abc123
                    messages:
                      - content: The issue was resolved.
                        role: assistant
                        timestamp: '2023-10-31T12:30:00Z'
                    namespace: default
                    replacements: { }
                    title: Updated Security Discussion
                    updatedAt: '2023-10-31T12:31:00Z'
                    users:
                      - id: user1
                        name: John Doe
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: 'Missing required field: title'
                  statusCode:
                    type: number
                    example: 400
              examples:
                UpdateConversationResponse400Example:
                  value:
                    error: Bad Request
                    message: 'Missing required field: title'
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request PUT 'http://localhost:5601/api/security_ai_assistant/current_user/conversations/abc123' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"title\":\"Updated Security Discussion\",\"category\":\"insights\",\"messages\":[{\"content\":\"Resolved.\",\"role\":\"assistant\",\"timestamp\":\"2023-10-31T12:30:00Z\"}],\"apiConfig\":{\"connectorId\":\"54321\",\"actionTypeId\":\"09876\"},\"replacements\":{},\"excludeFromLastConversationStorage\":true}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base:
    get:
      tags:
        - Security AI Assistant API
      summary: Read a KnowledgeBase
      description: Read a single KB
      operationId: GetKnowledgeBase
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseReadResponse200'
              examples:
                KnowledgeBaseReadResponse200Example2:
                  summary: A response that returns information about the knowledge base.
                  value:
                    defend_insights_exists: true
                    elser_exists: false
                    is_setup_available: true
                    is_setup_in_progress: true
                    product_documentation_status: installed
                    security_labs_exists: false
                    user_data_exists: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
              examples:
                GetKnowledgeBaseResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid resource ID provided.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security AI Assistant API
      summary: Create a KnowledgeBase
      description: Create a knowledge base. Use this endpoint when no specific resource identifier is needed.
      operationId: PostKnowledgeBase
      parameters:
        - name: modelId
          in: query
          description: 'ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.'
          schema:
            type: string
          example: elser-model-001
        - name: ignoreSecurityLabs
          in: query
          description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
          schema:
            type: boolean
            default: false
          example: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
              examples:
                KnowledgeBaseResponse200Example2:
                  summary: A response that indicates that the request was successful.
                  value:
                    success: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
              examples:
                KnowledgeBaseResponse400Example2:
                  summary: A response for a request that failed due to an invalid query parameter value.
                  value: "statusCode: 400 error: Bad Request message: \"[request query]: ignoreSecurityLabs: Invalid enum value. Expected 'true' | 'false', received 'yes', ignoreSecurityLabs: Expected boolean, received string\"\n"
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base?ignoreSecurityLabs=false' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security_ai_assistant/knowledge_base/{resource}':
    get:
      tags:
        - Security AI Assistant API
      summary: Read a KnowledgeBase for a resource
      description: Read a knowledge base with a specific resource identifier.
      operationId: ReadKnowledgeBase
      parameters:
        - name: resource
          in: path
          description: The KnowledgeBase `resource` value.
          required: true
          schema:
            type: string
          example: kb12345
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseReadResponse200'
              examples:
                KnowledgeBaseReadResponse200Example1:
                  summary: A response that returns information about the knowledge base.
                  value:
                    defend_insights_exists: true
                    elser_exists: false
                    is_setup_available: true
                    is_setup_in_progress: true
                    product_documentation_status: installed
                    security_labs_exists: false
                    user_data_exists: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
              examples:
                ReadKnowledgeBaseResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid resource ID provided.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/kb12345' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security AI Assistant API
      summary: Create a KnowledgeBase for a resource
      description: Create a knowledge base with a specific resource identifier.
      operationId: CreateKnowledgeBase
      parameters:
        - name: resource
          in: path
          description: The KnowledgeBase `resource` value.
          required: true
          schema:
            type: string
          example: kb12345
        - name: modelId
          in: query
          description: 'ELSER modelId to use when setting up the Knowledge Base. If not provided, a default model will be used.'
          schema:
            type: string
          example: elser-model-001
        - name: ignoreSecurityLabs
          in: query
          description: Indicates whether we should or should not install Security Labs docs when setting up the Knowledge Base. Defaults to `false`.
          schema:
            type: boolean
            default: false
          example: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse'
              examples:
                KnowledgeBaseResponse200Example1:
                  summary: A response that indicates that the request was successful.
                  value:
                    success: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResponse400'
              examples:
                KnowledgeBaseResponse400Example1:
                  summary: A response for a request that failed due to an invalid query parameter value.
                  value: "statusCode: 400 error: Bad Request message: \"[request query]: ignoreSecurityLabs: Invalid enum value. Expected 'true' | 'false', received 'yes', ignoreSecurityLabs: Expected boolean, received string\"\n"
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/kb12345?ignoreSecurityLabs=false' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries:
    post:
      tags:
        - Security AI Assistant API
      summary: Create a Knowledge Base Entry
      description: Create a Knowledge Base Entry
      operationId: CreateKnowledgeBaseEntry
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
            examples:
              CreateKnowledgeBaseEntryRequest:
                value:
                  kbResource: user
                  name: How to reset a password
                  source: manual
                  text: 'To reset your password, go to the settings page and click ''Reset Password''.'
                  type: document
        required: true
      responses:
        '200':
          description: Successful request returning Knowledge Base Entries
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
              examples:
                CreateKnowledgeBaseEntryResponse200Example:
                  value:
                    createdAt: '2024-01-15T10:00:00.000Z'
                    createdBy: user@example.com
                    global: false
                    id: '12345'
                    kbResource: user
                    name: How to reset a password
                    namespace: default
                    source: manual
                    text: 'To reset your password, go to the settings page and click ''Reset Password''.'
                    type: document
                    updatedAt: '2024-01-15T10:00:00.000Z'
                    updatedBy: user@example.com
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
              examples:
                CreateKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Invalid input
                    message: The 'name' field is required.
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"name\":\"How to reset a password\",\"type\":\"document\",\"kbResource\":\"user\",\"source\":\"manual\",\"text\":\"To reset your password, go to the settings page and click Reset Password.\"}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries/_bulk_action:
    post:
      tags:
        - Security AI Assistant API
      summary: Applies a bulk action to multiple Knowledge Base Entries
      description: The bulk action is applied to all Knowledge Base Entries that match the filter or to the list of Knowledge Base Entries by their IDs.
      operationId: PerformKnowledgeBaseEntryBulkAction
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                create:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps'
                  description: List of Knowledge Base Entries to create.
                  example:
                    - kbResource: user
                      name: New Entry
                      source: manual
                      text: This is the content of the new entry.
                      type: document
                delete:
                  type: object
                  properties:
                    ids:
                      minItems: 1
                      type: array
                      items:
                        type: string
                      description: Array of Knowledge Base Entry IDs.
                      example:
                        - '123'
                        - '456'
                        - '789'
                    query:
                      type: string
                      description: Query to filter Knowledge Base Entries.
                      example: status:active AND category:technology
                update:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps'
                  description: List of Knowledge Base Entries to update.
                  example:
                    - id: '123'
                      kbResource: user
                      name: Updated Entry
                      source: manual
                      text: Updated content.
                      type: document
            examples:
              PerformKnowledgeBaseEntryBulkActionRequest:
                value:
                  create:
                    - kbResource: user
                      name: New Entry
                      source: manual
                      text: This is the content of the new entry.
                      type: document
                  delete:
                    ids:
                      - '789'
                  update:
                    - id: '123'
                      kbResource: user
                      name: Updated Entry
                      source: manual
                      text: Updated content.
                      type: document
      responses:
        '200':
          description: Successful bulk operation request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse'
              examples:
                PerformKnowledgeBaseEntryBulkActionResponse200Example:
                  value:
                    attributes:
                      results:
                        created:
                          - createdAt: '2024-01-15T10:00:00.000Z'
                            createdBy: user@example.com
                            global: false
                            id: '456'
                            kbResource: user
                            name: New Entry
                            namespace: default
                            source: manual
                            text: This is the content of the new entry.
                            type: document
                            updatedAt: '2024-01-15T10:00:00.000Z'
                            updatedBy: user@example.com
                        deleted:
                          - '789'
                        skipped: [ ]
                        updated:
                          - createdAt: '2024-01-14T09:00:00.000Z'
                            createdBy: user@example.com
                            global: false
                            id: '123'
                            kbResource: user
                            name: Updated Entry
                            namespace: default
                            source: manual
                            text: Updated content.
                            type: document
                            updatedAt: '2024-01-15T10:00:00.000Z'
                            updatedBy: user@example.com
                      summary:
                        failed: 0
                        skipped: 0
                        succeeded: 3
                        total: 3
                    knowledgeBaseEntriesCount: 3
                    message: Bulk action completed successfully.
                    statusCode: 200
                    success: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
              examples:
                PerformKnowledgeBaseEntryBulkActionResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid request body.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_bulk_action' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"create\":[{\"name\":\"Runbook\",\"type\":\"document\",\"kbResource\":\"user\",\"source\":\"manual\",\"text\":\"Steps to triage an alert.\"}]}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/knowledge_base/entries/_find:
    get:
      tags:
        - Security AI Assistant API
      summary: Finds Knowledge Base Entries that match the given query.
      description: Finds Knowledge Base Entries that match the given query.
      operationId: FindKnowledgeBaseEntries
      parameters:
        - name: fields
          in: query
          description: 'A list of fields to include in the response. If not provided, all fields will be included.'
          schema:
            type: array
            items:
              type: string
            example:
              - name
              - created_at
        - name: filter
          in: query
          description: Search query to filter Knowledge Base Entries by specific criteria.
          schema:
            type: string
            example: error handling
        - name: sort_field
          in: query
          description: Field to sort the Knowledge Base Entries by.
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField'
        - name: sort_order
          in: query
          description: 'Sort order for the results, either asc or desc.'
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
        - name: page
          in: query
          description: Page number for paginated results. Defaults to 1.
          schema:
            minimum: 1
            type: integer
            default: 1
            example: 2
        - name: per_page
          in: query
          description: Number of Knowledge Base Entries to return per page. Defaults to 20.
          schema:
            minimum: 0
            type: integer
            default: 20
            example: 10
      responses:
        '200':
          description: Successful response containing the paginated Knowledge Base Entries.
          content:
            application/json:
              schema:
                required:
                  - page
                  - perPage
                  - total
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
                    description: The list of Knowledge Base Entries for the current page.
                  page:
                    type: integer
                    description: The current page number.
                    example: 1
                  perPage:
                    type: integer
                    description: The number of Knowledge Base Entries returned per page.
                    example: 20
                  total:
                    type: integer
                    description: The total number of Knowledge Base Entries available.
                    example: 100
              examples:
                FindKnowledgeBaseEntriesResponse200Example:
                  value:
                    data:
                      - createdAt: '2024-01-15T10:00:00.000Z'
                        createdBy: user@example.com
                        global: false
                        id: '12345'
                        kbResource: user
                        name: How to reset a password
                        namespace: default
                        source: manual
                        text: 'To reset your password, go to the settings page and click ''Reset Password''.'
                        type: document
                        updatedAt: '2024-01-15T10:00:00.000Z'
                        updatedBy: user@example.com
                    page: 1
                    perPage: 20
                    total: 100
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: A short description of the error.
                    example: Bad Request
                  message:
                    type: string
                    description: A detailed message explaining the error.
                    example: 'Invalid query parameter: sort_order'
                  statusCode:
                    type: number
                    description: The HTTP status code of the error.
                    example: 400
              examples:
                FindKnowledgeBaseEntriesResponse400Example:
                  value:
                    error: Bad Request
                    message: 'Invalid query parameter: sort_order'
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security_ai_assistant/knowledge_base/entries/{id}':
    delete:
      tags:
        - Security AI Assistant API
      summary: Deletes a single Knowledge Base Entry using the `id` field
      description: Delete a Knowledge Base Entry by its unique `id`.
      operationId: DeleteKnowledgeBaseEntry
      parameters:
        - name: id
          in: path
          description: The unique identifier (`id`) of the Knowledge Base Entry to delete.
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
          example: '12345'
      responses:
        '200':
          description: Successful request returning the `id` of the deleted Knowledge Base Entry.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_DeleteResponseFields'
              examples:
                DeleteKnowledgeBaseEntryResponse200Example:
                  value:
                    id: '12345'
                    message: Knowledge Base Entry successfully deleted.
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
              examples:
                DeleteKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Not Found
                    message: No Knowledge Base Entry found with the provided `id`.
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request DELETE 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security AI Assistant API
      summary: Read a Knowledge Base Entry
      description: Retrieve a Knowledge Base Entry by its unique `id`.
      operationId: ReadKnowledgeBaseEntry
      parameters:
        - name: id
          in: path
          description: The unique identifier (`id`) of the Knowledge Base Entry to retrieve.
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
          example: '12345'
      responses:
        '200':
          description: Successful request returning the requested Knowledge Base Entry.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
              examples:
                ReadKnowledgeBaseEntryResponse200Example:
                  value:
                    createdAt: '2024-01-15T10:00:00.000Z'
                    createdBy: user@example.com
                    global: false
                    id: '12345'
                    kbResource: user
                    name: How to reset a password
                    namespace: default
                    source: manual
                    text: 'To reset your password, go to the settings page and click ''Reset Password''.'
                    type: document
                    updatedAt: '2024-01-15T10:00:00.000Z'
                    updatedBy: user@example.com
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
              examples:
                ReadKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Not Found
                    message: No Knowledge Base Entry found with the provided `id`.
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security AI Assistant API
      summary: Update a Knowledge Base Entry
      description: Update an existing Knowledge Base Entry by its unique `id`.
      operationId: UpdateKnowledgeBaseEntry
      parameters:
        - name: id
          in: path
          description: The unique identifier (`id`) of the Knowledge Base Entry to update.
          required: true
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
          example: '12345'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps'
            examples:
              UpdateKnowledgeBaseEntryRequest:
                value:
                  kbResource: user
                  name: How to reset a password (updated)
                  source: manual
                  text: 'Updated: go to settings and click Reset Password, then follow the on-screen instructions.'
                  type: document
        required: true
      responses:
        '200':
          description: Successful request returning the updated Knowledge Base Entry.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
              examples:
                UpdateKnowledgeBaseEntryResponse200Example:
                  value:
                    createdAt: '2024-01-15T10:00:00.000Z'
                    createdBy: user@example.com
                    global: false
                    id: '12345'
                    kbResource: user
                    name: How to reset a password (updated)
                    namespace: default
                    source: manual
                    text: 'Updated: go to settings and click Reset Password, then follow the on-screen instructions.'
                    type: document
                    updatedAt: '2024-01-15T10:05:00.000Z'
                    updatedBy: user@example.com
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema'
              examples:
                UpdateKnowledgeBaseEntryResponse400Example:
                  value:
                    error: Invalid input
                    message: The 'text' field cannot be empty.
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request PUT 'http://localhost:5601/api/security_ai_assistant/knowledge_base/entries/12345' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"name\":\"How to reset a password (updated)\",\"type\":\"document\",\"kbResource\":\"user\",\"source\":\"manual\",\"text\":\"Updated: go to settings and click Reset Password, then follow the on-screen instructions.\"}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/prompts/_bulk_action:
    post:
      tags:
        - Security AI Assistant API
      summary: Apply a bulk action to prompts
      description: 'Apply a bulk action to multiple prompts. The bulk action is applied to all prompts that match the filter or to the list of prompts by their IDs. This action allows for bulk create, update, or delete operations.'
      operationId: PerformPromptsBulkAction
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                create:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_PromptCreateProps'
                  description: List of prompts to be created.
                delete:
                  type: object
                  properties:
                    ids:
                      minItems: 1
                      type: array
                      items:
                        type: string
                      description: Array of IDs to apply the action to.
                      example:
                        - '1234'
                        - '5678'
                    query:
                      type: string
                      description: Query to filter the bulk action.
                      example: 'status: ''inactive'''
                  description: Criteria for deleting prompts in bulk.
                update:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_AI_Assistant_API_PromptUpdateProps'
                  description: List of prompts to be updated.
            examples:
              PerformPromptsBulkActionRequest:
                value:
                  create:
                    - content: Please verify the security settings.
                      name: New Security Prompt
                      promptType: system
                  delete:
                    ids:
                      - prompt1
                      - prompt2
                  update:
                    - content: Updated content for security prompt.
                      id: prompt123
      responses:
        '200':
          description: Indicates a successful call with the results of the bulk action.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResponse'
              examples:
                success:
                  value:
                    attributes:
                      errors: [ ]
                      results:
                        created:
                          - content: Please verify the security settings.
                            id: prompt6
                            name: New Security Prompt
                            promptType: system
                        deleted:
                          - prompt2
                          - prompt3
                        skipped:
                          - id: prompt4
                            name: Security Prompt
                            skip_reason: PROMPT_FIELD_NOT_MODIFIED
                        updated:
                          - content: Updated security settings prompt
                            id: prompt1
                            name: Security Prompt
                            promptType: system
                      summary:
                        failed: 0
                        skipped: 1
                        succeeded: 4
                        total: 5
                    message: Bulk action completed successfully.
                    prompts_count: 5
                    status_code: 200
                    success: true
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: A short error message.
                    example: Bad Request
                  message:
                    type: string
                    description: A detailed error message.
                    example: Invalid prompt ID or missing required fields.
                  statusCode:
                    type: number
                    description: The HTTP status code for the error.
                    example: 400
              examples:
                PerformPromptsBulkActionResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid prompt ID or missing required fields.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request POST 'http://localhost:5601/api/security_ai_assistant/prompts/_bulk_action' \\\n --header \"Authorization: $API_KEY\" \\\n --header \"Content-Type: application/json\" \\\n --data '{\"delete\":{\"query\":\"name: test\",\"ids\":[]}}'\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_ai_assistant/prompts/_find:
    get:
      tags:
        - Security AI Assistant API
      summary: Get prompts
      description: 'Get a list of all prompts based on optional filters, sorting, and pagination.'
      operationId: FindPrompts
      parameters:
        - name: fields
          in: query
          description: List of specific fields to include in each returned prompt.
          schema:
            type: array
            items:
              type: string
            example:
              - id
              - name
              - content
        - name: filter
          in: query
          description: Search query string to filter prompts by matching fields.
          schema:
            type: string
            example: error handling
        - name: sort_field
          in: query
          description: Field to sort prompts by.
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_FindPromptsSortField'
        - name: sort_order
          in: query
          description: 'Sort order, either asc or desc.'
          schema:
            $ref: '#/components/schemas/Security_AI_Assistant_API_SortOrder'
        - name: page
          in: query
          description: Page number for pagination.
          schema:
            minimum: 1
            type: integer
            default: 1
            example: 1
        - name: per_page
          in: query
          description: Number of prompts per page.
          schema:
            minimum: 0
            type: integer
            default: 20
            example: 20
      responses:
        '200':
          description: Successful response containing a list of prompts.
          content:
            application/json:
              schema:
                required:
                  - page
                  - perPage
                  - total
                  - data
                type: object
                properties:
                  data:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
                    description: 'The list of prompts returned based on the search query, sorting, and pagination.'
                  page:
                    type: integer
                    description: Current page number.
                    example: 1
                  perPage:
                    type: integer
                    description: Number of prompts per page.
                    example: 20
                  total:
                    type: integer
                    description: Total number of prompts matching the query.
                    example: 142
                example:
                  data:
                    - categories:
                        - troubleshooting
                        - logging
                      color: '#FF5733'
                      consumer: security
                      content: 'If you encounter an error, check the logs and retry.'
                      createdAt: '2025-04-20T21:00:00Z'
                      createdBy: jdoe
                      id: prompt-123
                      isDefault: true
                      isNewConversationDefault: false
                      name: Error Troubleshooting Prompt
                      namespace: default
                      promptType: standard
                      timestamp: '2025-04-30T22:30:00Z'
                      updatedAt: '2025-04-30T22:45:00Z'
                      updatedBy: jdoe
                      users:
                        - full_name: John Doe
                          username: jdoe
                  page: 1
                  perPage: 20
                  total: 142
              examples:
                FindPromptsResponse200Example:
                  value:
                    data:
                      - categories:
                          - troubleshooting
                          - logging
                        color: '#FF5733'
                        consumer: security
                        content: 'If you encounter an error, check the logs and retry.'
                        createdAt: '2025-04-20T21:00:00Z'
                        createdBy: jdoe
                        id: prompt-123
                        isDefault: true
                        isNewConversationDefault: false
                        name: Error Troubleshooting Prompt
                        namespace: default
                        promptType: standard
                        timestamp: '2025-04-30T22:30:00Z'
                        updatedAt: '2025-04-30T22:45:00Z'
                        updatedBy: jdoe
                        users:
                          - full_name: John Doe
                            username: jdoe
                    page: 1
                    perPage: 20
                    total: 142
        '400':
          description: Bad request due to invalid parameters or malformed query.
          content:
            application/json:
              schema:
                type: object
                properties:
                  error:
                    type: string
                    description: Short error message.
                    example: Bad Request
                  message:
                    type: string
                    description: Detailed description of the error.
                    example: Invalid sort order value provided.
                  statusCode:
                    type: number
                    description: HTTP status code for the error.
                    example: 400
              examples:
                FindPromptsResponse400Example:
                  value:
                    error: Bad Request
                    message: Invalid sort order value provided.
                    statusCode: 400
      x-codeSamples:
        - label: Example request
          lang: curl
          source: "curl \\\n --request GET 'http://localhost:5601/api/security_ai_assistant/prompts/_find?page=1&per_page=20' \\\n --header \"Authorization: $API_KEY\"\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security_solution/initialize:
    post:
      tags:
        - Security Solution Initialization API
      summary: Initialize security solution flows
      description: "Run one or more Security Solution initialization flows for the current space.\nEach flow provisions a specific set of assets, for example list indices,\nsecurity data views, prebuilt detection rules, endpoint protection, AI prompts,\nor detection rule monitoring assets. Only the requested flows are run, and the\nresponse reports a result for each one.\n"
      operationId: InitializeSecuritySolution
      requestBody:
        description: The initialization flows to run.
        content:
          application/json:
            schema:
              required:
                - flows
              type: object
              properties:
                flows:
                  minItems: 1
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowId'
            examples:
              default:
                value:
                  flows:
                    - init-prebuilt-rules
                    - init-endpoint-protection
                    - init-ai-prompts
        required: true
      responses:
        '200':
          description: Indicates a successful call. Returns a result for each requested flow.
          content:
            application/json:
              schema:
                required:
                  - flows
                type: object
                properties:
                  flows:
                    $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowsResult'
              examples:
                default:
                  value:
                    flows:
                      init-ai-prompts:
                        payload:
                          install_status: installed
                          name: security_ai_prompts
                          version: '8.17.1'
                        status: ready
                      init-endpoint-protection:
                        payload:
                          install_status: already_installed
                          name: endpoint
                          version: '8.17.1'
                        status: ready
                      init-prebuilt-rules:
                        payload:
                          install_status: installed
                          name: security_detection_engine
                          version: '8.17.1'
                        status: ready
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store:
    put:
      tags:
        - Security entity store
      summary: Update the Entity Store
      description: 'Update the Entity Store log extraction configuration. Omitting a field leaves it unchanged. Sending `null` for a field clears that override and reverts to the default value.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - logExtraction
              type: object
              properties:
                logExtraction:
                  type: object
                  properties:
                    additionalIndexPatterns:
                      maxItems: 1000
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 2048
                        type: string
                    delay:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                    docsLimit:
                      maximum: 9007199254740991
                      minimum: 1
                      type:
                        - 'null'
                        - integer
                    excludedIndexPatterns:
                      maxItems: 1000
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 2048
                        type: string
                    fieldHistoryLength:
                      maximum: 9007199254740991
                      minimum: -9007199254740991
                      type:
                        - 'null'
                        - integer
                    frequency:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                    lookbackPeriod:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                    maxLogsPerPage:
                      maximum: 9007199254740991
                      minimum: 1
                      type:
                        - 'null'
                        - integer
                    maxLogsPerWindow:
                      maximum: 9007199254740991
                      minimum: 0
                      type:
                        - 'null'
                        - integer
                    maxLogsPerWindowCapBehavior:
                      enum:
                        - defer
                        - drop
                      type:
                        - 'null'
                        - string
                    maxTimeWindowSize:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                  additionalProperties: false
              additionalProperties: false
            examples:
              clearLogExtractionOverrideExample:
                summary: Clear log extraction overrides
                description: Send null for any field to clear that override and revert it to the default value.
                value:
                  logExtraction:
                    delay: 'null'
                    frequency: 'null'
              updateLogExtractionExample:
                summary: Update log extraction settings
                description: Update the log extraction configuration with a new lookback period and frequency.
                value:
                  logExtraction:
                    fieldHistoryLength: 15
                    frequency: 10m
                    lookbackPeriod: 6h
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                updateSuccessExample:
                  summary: Entity Store updated
                  description: The Entity Store configuration was successfully updated.
                  value:
                    ok: true
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                invalidDurationExample:
                  summary: Invalid duration parameter
                  description: A log extraction parameter has an invalid duration format.
                  value:
                    error: Bad Request
                    message: '[request body]: logExtraction.frequency: must be a valid duration of at least 30 seconds (e.g. 1m, 30s)'
                    statusCode: 400
        '404':
          description: Entity Store not found.
          content:
            application/json:
              examples:
                notFoundExample:
                  summary: Entity Store not installed
                  description: The Entity Store has not been installed yet.
                  value:
                    error: Not Found
                    message: Entity store is not installed
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"logExtraction\":{\"lookbackPeriod\":\"6h\",\"frequency\":\"10m\",\"fieldHistoryLength\":15}}' \\\n  \"${KIBANA_URL}/api/security/entity_store\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store\n{\n  \"logExtraction\": {\n    \"lookbackPeriod\": \"6h\",\n    \"frequency\": \"10m\",\n    \"fieldHistoryLength\": 15\n  }\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities:
    get:
      tags:
        - Security entity store
      summary: List entities
      description: 'List entity records from the Entity Store with paging, sorting, and filtering. Supports two modes: page-based pagination (page/per_page) and cursor-based pagination (searchAfter). The two modes cannot be combined.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: get-security-entity-store-entities
      parameters:
        - name: filter
          in: query
          description: A Kibana Query Language (KQL) filter for the search-after mode.
          schema:
            type: string
        - name: size
          in: query
          description: Number of entities to return in search-after mode.
          schema:
            maximum: 9007199254740991
            minimum: 1
            type: integer
        - name: searchAfter
          in: query
          description: JSON-encoded search_after value for cursor-based pagination.
          schema:
            type: string
        - name: source
          in: query
          description: Fields to include in the response source.
          schema:
            type: array
            items:
              type: string
        - name: fields
          in: query
          description: Fields to include in the response.
          schema:
            type: array
            items:
              type: string
        - name: sort_field
          in: query
          description: Field to sort results by in page mode.
          schema:
            type: string
        - name: sort_order
          in: query
          description: Sort order in page mode.
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: page
          in: query
          description: Page number to return (1-indexed) in page mode.
          schema:
            maximum: 9007199254740991
            minimum: 1
            type: integer
        - name: per_page
          in: query
          description: Number of entities per page in page mode.
          schema:
            maximum: 10000
            minimum: 1
            type: integer
        - name: filterQuery
          in: query
          description: An Elasticsearch query string to filter entities in page mode.
          schema:
            type: string
        - name: entity_types
          in: query
          description: Entity types to include in the results.
          schema:
            type: array
            items:
              enum:
                - user
                - host
                - service
                - generic
              type: string
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                emptyResultExample:
                  summary: Empty result
                  description: No entities matched the query.
                  value:
                    page: 1
                    per_page: 10
                    records: [ ]
                    total: 0
                pageModeExample:
                  summary: Page mode response with host entities
                  description: "A paginated list of host entities sorted by timestamp in descending order, including query inspection data.\n"
                  value:
                    inspect:
                      dsl:
                        - '{"index":["entities-latest-default"],"body":{"terms":{"entity.EngineMetadata.Type":["host"]}}}'
                      response:
                        - '{"took":1,"timed_out":false,"hits":{"total":{"value":1,"relation":"eq"}}}'
                    page: 1
                    per_page: 10
                    records:
                      - '@timestamp': '2026-04-10T08:30:00.000Z'
                        asset:
                          criticality: high_impact
                          environment: production
                        entity:
                          attributes:
                            asset: true
                            managed: true
                          id: host:web-server-prod-01
                          lifecycle:
                            first_seen: '2026-01-15T10:00:00.000Z'
                            last_activity: '2026-04-10T08:30:00.000Z'
                          name: web-server-prod-01
                          risk:
                            calculated_level: Moderate
                            calculated_score: 47.5
                            calculated_score_norm: 47.5
                          source:
                            - logs
                          type: host
                        host:
                          hostname:
                            - web-server-prod-01.example.com
                          ip:
                            - 10.0.1.42
                          name: web-server-prod-01
                          os:
                            name: Ubuntu
                            type: linux
                    total: 1
                searchAfterModeExample:
                  summary: Search-after mode response
                  description: "A cursor-based response with entities and a search_after token for the next page.\n"
                  value:
                    entities:
                      - '@timestamp': '2026-04-10T08:30:00.000Z'
                        entity:
                          id: user:jane.doe@example.com
                          name: jane.doe
                          type: user
                        user:
                          email:
                            - jane.doe@example.com
                          name: jane.doe
                    nextSearchAfter:
                      - 1712736600000
                      - 1
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                invalidFilterExample:
                  summary: Invalid filter
                  description: The provided Kibana Query Language filter could not be parsed.
                  value:
                    error: Bad Request
                    message: "Invalid filter: Expected \"(\", \"{\", value, whitespace but \":\" found.\ninvalid :: query\n---------^"
                    statusCode: 400
                mixedModesExample:
                  summary: Mixed pagination modes
                  description: Cannot combine page-based pagination with cursor-based pagination in the same request.
                  value:
                    error: Bad Request
                    message: '[request query]: Cannot combine page/per_page with searchAfter'
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n  \"${KIBANA_URL}/api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=%40timestamp&sort_order=desc\"\n"
        - lang: Console
          source: "GET kbn://api/security/entity_store/entities?entity_types=host&page=1&per_page=10&sort_field=@timestamp&sort_order=desc\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities/:
    delete:
      tags:
        - Security entity store
      summary: Delete an entity
      description: 'Delete a single entity record from the Entity Store. The entity is immediately removed from the latest index.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: delete-security-entity-store-entities
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - entityId
              type: object
              properties:
                entityId:
                  type: string
                  description: The identifier of the entity to delete.
              additionalProperties: false
            examples:
              deleteEntityExample:
                summary: Delete an entity by identifier
                description: Delete a single entity from the Entity Store using its entity identifier.
                value:
                  entityId: host:web-server-prod-01
      responses:
        '200':
          description: Indicates the entity was successfully deleted.
          content:
            application/json:
              examples:
                deleteSuccessExample:
                  summary: Entity deleted
                  description: The entity was found and successfully removed from the latest index.
                  value:
                    deleted: true
        '404':
          description: Entity not found.
          content:
            application/json:
              examples:
                notFoundExample:
                  summary: Entity not found
                  description: No entity with the specified identifier exists in the Entity Store.
                  value:
                    error: Not Found
                    message: Entity ID 'host:web-server-prod-01' not found
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl -X DELETE -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entityId\":\"host:web-server-prod-01\"}' \\\n  \"${KIBANA_URL}/api/security/entity_store/entities/\"\n"
        - lang: Console
          source: "DELETE kbn://api/security/entity_store/entities/\n{\n  \"entityId\": \"host:web-server-prod-01\"\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security/entity_store/entities/{entityType}':
    post:
      tags:
        - Security entity store
      summary: Create an entity
      description: 'Create a new entity record in the Entity Store for the specified entity type.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: post-security-entity-store-entities-entitytype
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: entityType
          in: path
          description: The entity type to create.
          required: true
          schema:
            enum:
              - user
              - host
              - service
              - generic
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                      additionalProperties: false
                    labels:
                      type: object
                      additionalProperties: { }
                      description: Custom key-value labels attached to the entity.
                    tags:
                      type: array
                      items:
                        type: string
                      description: Tags attached to the entity.
                    user:
                      type: object
                      properties:
                        domain:
                          type: array
                          items:
                            type: string
                          description: Observed user domains.
                        email:
                          type: array
                          items:
                            type: string
                          description: Observed email addresses.
                        full_name:
                          type: array
                          items:
                            type: string
                          description: Observed full names of the user.
                        hash:
                          type: array
                          items:
                            type: string
                          description: Observed user hashes.
                        id:
                          type: array
                          items:
                            type: string
                          description: Observed user identifiers.
                        name:
                          type: string
                          description: Primary user name.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score.
                          additionalProperties: false
                        roles:
                          type: array
                          items:
                            type: string
                          description: Observed roles assigned to the user.
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) user fields collected on the entity.
                  additionalProperties: false
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                      additionalProperties: false
                    host:
                      type: object
                      properties:
                        architecture:
                          type: array
                          items:
                            type: string
                          description: Observed CPU architectures.
                        domain:
                          type: array
                          items:
                            type: string
                          description: Observed host domains.
                        hostname:
                          type: array
                          items:
                            type: string
                          description: Observed hostnames.
                        id:
                          type: array
                          items:
                            type: string
                          description: Observed host identifiers.
                        ip:
                          type: array
                          items:
                            type: string
                          description: Observed IP addresses.
                        mac:
                          type: array
                          items:
                            type: string
                          description: Observed MAC addresses.
                        name:
                          type: string
                          description: Primary host name.
                        os:
                          type: object
                          properties:
                            family:
                              type: string
                            full:
                              type: string
                            kernel:
                              type: string
                            name:
                              anyOf:
                                - type: string
                                - type: array
                                  items:
                                    type: string
                            platform:
                              type: string
                            type:
                              anyOf:
                                - type: string
                                - type: array
                                  items:
                                    type: string
                            version:
                              type: string
                          additionalProperties: false
                          description: Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score.
                          additionalProperties: false
                        type:
                          type: array
                          items:
                            type: string
                          description: Observed host types.
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) host fields collected on the entity.
                    labels:
                      type: object
                      additionalProperties: { }
                      description: Custom key-value labels attached to the entity.
                    tags:
                      type: array
                      items:
                        type: string
                      description: Tags attached to the entity.
                  additionalProperties: false
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                      additionalProperties: false
                    labels:
                      type: object
                      additionalProperties: { }
                      description: Custom key-value labels attached to the entity.
                    service:
                      type: object
                      properties:
                        address:
                          type: string
                          description: Service address.
                        environment:
                          type: string
                          description: 'Service environment (for example, production, staging).'
                        ephemeral_id:
                          type: string
                          description: Ephemeral identifier of the service.
                        id:
                          type: string
                          description: Unique identifier of the service.
                        name:
                          type: string
                          description: Primary service name.
                        node:
                          type: object
                          properties:
                            name:
                              type: string
                              description: Node name.
                            role:
                              type: string
                              description: Node role.
                            roles:
                              type: array
                              items:
                                type: string
                              description: Node roles.
                          additionalProperties: false
                          description: Node information for the service.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score.
                          additionalProperties: false
                        state:
                          type: string
                          description: Current state of the service.
                        type:
                          type: string
                          description: Service type.
                        version:
                          type: string
                          description: Service version.
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) service fields collected on the entity.
                    tags:
                      type: array
                      items:
                        type: string
                      description: Tags attached to the entity.
                  additionalProperties: false
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    cloud:
                      type: object
                      properties:
                        account:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        availability_zone:
                          type: string
                        instance:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        machine:
                          type: object
                          properties:
                            type:
                              type: string
                          additionalProperties: false
                        project:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        provider:
                          type: string
                        region:
                          type: string
                        service:
                          type: object
                          properties:
                            name:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          format: date-time
                      additionalProperties: false
                    labels:
                      type: object
                      additionalProperties: { }
                    orchestrator:
                      type: object
                      properties:
                        api_version:
                          type: string
                        cluster:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                            url:
                              type: string
                            version:
                              type: string
                          additionalProperties: false
                        namespace:
                          type: string
                        organization:
                          type: string
                        resource:
                          type: object
                          properties:
                            annotation:
                              type: string
                            id:
                              type: string
                            ip:
                              type: string
                            label:
                              type: string
                            name:
                              type: string
                            parent:
                              type: object
                              properties:
                                type:
                                  type: string
                              additionalProperties: false
                            type:
                              type: string
                          additionalProperties: false
                        type:
                          type: string
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
                    tags:
                      type: array
                      items:
                        type: string
                  additionalProperties: false
            examples:
              createHostEntityExample:
                summary: Create a host entity
                description: Create a new host entity record with basic host and entity fields. The entity identifier must match the auto-generated format for the entity type.
                value:
                  asset:
                    business_unit: Engineering
                    criticality: high_impact
                    environment: production
                  entity:
                    attributes:
                      asset: true
                      managed: true
                    id: host:web-server-prod-01
                    name: web-server-prod-01
                    source:
                      - manual
                    type: host
                  host:
                    hostname:
                      - web-server-prod-01.example.com
                    ip:
                      - 10.0.1.42
                    name: web-server-prod-01
      responses:
        '200':
          description: Indicates the entity was successfully created.
          content:
            application/json:
              examples:
                createSuccessExample:
                  summary: Entity created
                  description: The entity record was successfully created in the Entity Store.
                  value:
                    ok: true
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                euidMismatchExample:
                  summary: Entity identifier mismatch
                  description: The supplied entity identifier does not match the auto-generated identifier derived from the entity fields.
                  value:
                    error: Bad Request
                    message: 'Bad request: Supplied ID my-custom-id does not match generated EUID host:web-server-prod-01'
                    statusCode: 400
        '409':
          description: Conflict.
          content:
            application/json:
              examples:
                conflictExample:
                  summary: Entity already exists
                  description: An entity with the specified identifier already exists.
                  value:
                    error: Conflict
                    message: Entity ID 'host:web-server-prod-01' already exists
                    statusCode: 409
      x-codeSamples:
        - lang: curl
          source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"source\":[\"manual\"],\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\",\"ip\":[\"10.0.1.42\"]}}' \\\n  \"${KIBANA_URL}/api/security/entity_store/entities/host\"\n"
        - lang: Console
          source: "POST kbn://api/security/entity_store/entities/host\n{\n  \"entity\": {\n    \"id\": \"host:web-server-prod-01\",\n    \"name\": \"web-server-prod-01\",\n    \"type\": \"host\",\n    \"source\": [\"manual\"],\n    \"attributes\": { \"asset\": true }\n  },\n  \"host\": {\n    \"name\": \"web-server-prod-01\",\n    \"ip\": [\"10.0.1.42\"]\n  }\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Security entity store
      summary: Update an entity
      description: 'Update an existing entity record in the Entity Store. By default only certain fields can be updated. Set the `force` query parameter to `true` to update protected fields.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store-entities-entitytype
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: entityType
          in: path
          description: The entity type to update.
          required: true
          schema:
            enum:
              - user
              - host
              - service
              - generic
            type: string
        - name: force
          in: query
          description: 'When true, allows updating protected fields.'
          schema:
            anyOf:
              - enum:
                  - 'true'
                  - 'false'
                type: string
              - type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                      additionalProperties: false
                    labels:
                      type: object
                      additionalProperties: { }
                      description: Custom key-value labels attached to the entity.
                    tags:
                      type: array
                      items:
                        type: string
                      description: Tags attached to the entity.
                    user:
                      type: object
                      properties:
                        domain:
                          type: array
                          items:
                            type: string
                          description: Observed user domains.
                        email:
                          type: array
                          items:
                            type: string
                          description: Observed email addresses.
                        full_name:
                          type: array
                          items:
                            type: string
                          description: Observed full names of the user.
                        hash:
                          type: array
                          items:
                            type: string
                          description: Observed user hashes.
                        id:
                          type: array
                          items:
                            type: string
                          description: Observed user identifiers.
                        name:
                          type: string
                          description: Primary user name.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score.
                          additionalProperties: false
                        roles:
                          type: array
                          items:
                            type: string
                          description: Observed roles assigned to the user.
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) user fields collected on the entity.
                  additionalProperties: false
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                      additionalProperties: false
                    host:
                      type: object
                      properties:
                        architecture:
                          type: array
                          items:
                            type: string
                          description: Observed CPU architectures.
                        domain:
                          type: array
                          items:
                            type: string
                          description: Observed host domains.
                        hostname:
                          type: array
                          items:
                            type: string
                          description: Observed hostnames.
                        id:
                          type: array
                          items:
                            type: string
                          description: Observed host identifiers.
                        ip:
                          type: array
                          items:
                            type: string
                          description: Observed IP addresses.
                        mac:
                          type: array
                          items:
                            type: string
                          description: Observed MAC addresses.
                        name:
                          type: string
                          description: Primary host name.
                        os:
                          type: object
                          properties:
                            family:
                              type: string
                            full:
                              type: string
                            kernel:
                              type: string
                            name:
                              anyOf:
                                - type: string
                                - type: array
                                  items:
                                    type: string
                            platform:
                              type: string
                            type:
                              anyOf:
                                - type: string
                                - type: array
                                  items:
                                    type: string
                            version:
                              type: string
                          additionalProperties: false
                          description: Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score.
                          additionalProperties: false
                        type:
                          type: array
                          items:
                            type: string
                          description: Observed host types.
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) host fields collected on the entity.
                    labels:
                      type: object
                      additionalProperties: { }
                      description: Custom key-value labels attached to the entity.
                    tags:
                      type: array
                      items:
                        type: string
                      description: Tags attached to the entity.
                  additionalProperties: false
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          description: When the event was ingested into Elasticsearch.
                          format: date-time
                      additionalProperties: false
                    labels:
                      type: object
                      additionalProperties: { }
                      description: Custom key-value labels attached to the entity.
                    service:
                      type: object
                      properties:
                        address:
                          type: string
                          description: Service address.
                        environment:
                          type: string
                          description: 'Service environment (for example, production, staging).'
                        ephemeral_id:
                          type: string
                          description: Ephemeral identifier of the service.
                        id:
                          type: string
                          description: Unique identifier of the service.
                        name:
                          type: string
                          description: Primary service name.
                        node:
                          type: object
                          properties:
                            name:
                              type: string
                              description: Node name.
                            role:
                              type: string
                              description: Node role.
                            roles:
                              type: array
                              items:
                                type: string
                              description: Node roles.
                          additionalProperties: false
                          description: Node information for the service.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score.
                          additionalProperties: false
                        state:
                          type: string
                          description: Current state of the service.
                        type:
                          type: string
                          description: Service type.
                        version:
                          type: string
                          description: Service version.
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) service fields collected on the entity.
                    tags:
                      type: array
                      items:
                        type: string
                      description: Tags attached to the entity.
                  additionalProperties: false
                - type: object
                  properties:
                    '@timestamp':
                      pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                      type: string
                      description: The time the entity record was last updated.
                      format: date-time
                    asset:
                      type: object
                      properties:
                        business_unit:
                          type: string
                          description: Business unit the asset belongs to.
                        criticality:
                          enum:
                            - low_impact
                            - medium_impact
                            - high_impact
                            - extreme_impact
                          type:
                            - 'null'
                            - string
                          description: The criticality level assigned to this asset.
                        environment:
                          type: string
                          description: 'Deployment environment (for example, production, staging).'
                        id:
                          type: string
                          description: Unique identifier for the asset.
                        model:
                          type: string
                          description: Model name or number.
                        name:
                          type: string
                          description: Human-readable asset name.
                        owner:
                          type: string
                          description: The owner of the asset.
                        serial_number:
                          type: string
                          description: Serial number of the asset.
                        vendor:
                          type: string
                          description: Vendor or manufacturer.
                      additionalProperties: false
                    cloud:
                      type: object
                      properties:
                        account:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        availability_zone:
                          type: string
                        instance:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        machine:
                          type: object
                          properties:
                            type:
                              type: string
                          additionalProperties: false
                        project:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        provider:
                          type: string
                        region:
                          type: string
                        service:
                          type: object
                          properties:
                            name:
                              type: string
                          additionalProperties: false
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
                    entity:
                      type: object
                      properties:
                        attributes:
                          type: object
                          properties:
                            asset:
                              type: boolean
                              description: Whether the entity is classified as an asset.
                            known_redirects:
                              type: array
                              items:
                                type: string
                              description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                            managed:
                              type: boolean
                              description: 'Whether the entity is managed (for example, via a directory service).'
                            mfa_enabled:
                              type: boolean
                              description: Whether multi-factor authentication is enabled for the entity.
                            oauth_consent_restriction:
                              type: string
                              description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                            permissions:
                              type: array
                              items:
                                type: string
                              description: Action-level permissions granted to this entity (not roles or groups).
                            storage_class:
                              type: string
                              description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                            watchlists:
                              type: array
                              items:
                                type: string
                              description: Watchlist identifiers the entity belongs to (v2).
                          additionalProperties: false
                          description: Boolean flags describing characteristics of the entity.
                        behaviors:
                          type: object
                          properties:
                            anomaly_job_ids:
                              type: array
                              items:
                                type: string
                              description: Machine learning anomaly job identifiers (v2).
                            rule_names:
                              type: array
                              items:
                                type: string
                              description: Detection rule names that flagged this entity (v2).
                          additionalProperties: false
                          description: Behavioral signals observed for the entity.
                        created_by:
                          type: string
                          description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                        EngineMetadata:
                          type: object
                          properties:
                            Type:
                              type: string
                              description: The engine type that produced this entity record.
                          additionalProperties: false
                        id:
                          type: string
                          description: Unique identifier for this entity.
                        lifecycle:
                          type: object
                          properties:
                            first_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was first observed.
                              format: date-time
                            last_activity:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity last generated activity.
                              format: date-time
                            last_seen:
                              pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                              type: string
                              description: When the entity was last observed.
                              format: date-time
                          additionalProperties: false
                          description: Timestamps tracking the entity lifecycle.
                        name:
                          type: string
                          description: Human-readable name of the entity.
                        relationships:
                          type: object
                          properties:
                            accesses_frequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses frequently.
                            accesses_infrequently:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity accesses infrequently.
                            administers:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                            communicates_with:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity communicates with.
                            depends_on:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities this entity depends on.
                            owns:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities owned by this entity.
                            owns_inferred:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities inferred to be owned by this entity.
                            resolution:
                              type: object
                              properties:
                                resolved_to:
                                  type: string
                                  description: entity.id of the entity this one resolves to
                                risk:
                                  type: object
                                  properties:
                                    calculated_level:
                                      enum:
                                        - Unknown
                                        - Low
                                        - Moderate
                                        - High
                                        - Critical
                                      type: string
                                      description: Lexical description of the resolution group's aggregated risk.
                                    calculated_score:
                                      type: number
                                      description: The raw numeric value of the resolution group's aggregated risk score.
                                    calculated_score_norm:
                                      maximum: 100
                                      minimum: 0
                                      type: number
                                      description: The normalized numeric value of the resolution group's aggregated risk score.
                                  additionalProperties: false
                                  description: Aggregated risk score for the resolution group.
                              additionalProperties: false
                              description: Resolution metadata linking this entity to another.
                            supervises:
                              type: object
                              properties:
                                ids:
                                  type: array
                                  items:
                                    type: string
                                  description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                raw_identifiers:
                                  type: object
                                  properties:
                                    entity.id:
                                      type: array
                                      items:
                                        type: string
                                    host.id:
                                      type: array
                                      items:
                                        type: string
                                    host.name:
                                      type: array
                                      items:
                                        type: string
                                    service.name:
                                      type: array
                                      items:
                                        type: string
                                    user.email:
                                      type: array
                                      items:
                                        type: string
                                    user.id:
                                      type: array
                                      items:
                                        type: string
                                    user.name:
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                              description: Entities supervised by this entity.
                          additionalProperties: false
                          description: Connections between this entity and other entities.
                        risk:
                          type: object
                          properties:
                            calculated_level:
                              enum:
                                - Unknown
                                - Low
                                - Moderate
                                - High
                                - Critical
                              type: string
                              description: Lexical description of the entity's risk.
                            calculated_score:
                              type: number
                              description: The raw numeric value of the given entity's risk score.
                            calculated_score_norm:
                              maximum: 100
                              minimum: 0
                              type: number
                              description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                          additionalProperties: false
                          description: Risk scoring information for the entity.
                        schema_version:
                          type: string
                          description: Schema version of the entity record.
                        source:
                          type: array
                          items:
                            type: string
                          description: Sources that produced this entity record.
                        sub_type:
                          type: string
                          description: Optional sub-type classification for the entity.
                        type:
                          type: string
                          description: The entity type.
                        url:
                          type: string
                          description: URL associated with the entity.
                      additionalProperties: false
                    event:
                      type: object
                      properties:
                        ingested:
                          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                          type: string
                          format: date-time
                      additionalProperties: false
                    labels:
                      type: object
                      additionalProperties: { }
                    orchestrator:
                      type: object
                      properties:
                        api_version:
                          type: string
                        cluster:
                          type: object
                          properties:
                            id:
                              type: string
                            name:
                              type: string
                            url:
                              type: string
                            version:
                              type: string
                          additionalProperties: false
                        namespace:
                          type: string
                        organization:
                          type: string
                        resource:
                          type: object
                          properties:
                            annotation:
                              type: string
                            id:
                              type: string
                            ip:
                              type: string
                            label:
                              type: string
                            name:
                              type: string
                            parent:
                              type: object
                              properties:
                                type:
                                  type: string
                              additionalProperties: false
                            type:
                              type: string
                          additionalProperties: false
                        type:
                          type: string
                      additionalProperties: false
                      description: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
                    tags:
                      type: array
                      items:
                        type: string
                  additionalProperties: false
            examples:
              updateEntityAttributesExample:
                summary: Update entity attributes
                description: Update the attributes of an existing user entity. Fields like entity.name and entity.type are protected and require the force query parameter.
                value:
                  entity:
                    attributes:
                      managed: true
                      mfa_enabled: true
                    id: user:jane.doe@example.com
                    lifecycle:
                      last_activity: '2026-04-10T14:30:00.000Z'
                    name: jane.doe
                    type: user
                  user:
                    email:
                      - jane.doe@example.com
                    name: jane.doe
                    roles:
                      - admin
                      - analyst
      responses:
        '200':
          description: Indicates the entity was successfully updated.
          content:
            application/json:
              examples:
                updateSuccessExample:
                  summary: Entity updated
                  description: The entity record was successfully updated.
                  value:
                    ok: true
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                protectedFieldsExample:
                  summary: Protected fields without force
                  description: The request attempts to update protected fields without the force query parameter.
                  value:
                    error: Bad Request
                    message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type'
                    statusCode: 400
        '404':
          description: Entity not found.
          content:
            application/json:
              examples:
                notFoundExample:
                  summary: Entity not found
                  description: No entity with the specified identifier exists.
                  value:
                    error: Not Found
                    message: Entity ID 'user:jane.doe@example.com' not found
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entity\":{\"id\":\"user:jane.doe@example.com\",\"name\":\"jane.doe\",\"type\":\"user\",\"attributes\":{\"managed\":true,\"mfa_enabled\":true}},\"user\":{\"name\":\"jane.doe\"}}' \\\n  \"${KIBANA_URL}/api/security/entity_store/entities/user?force=true\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store/entities/user?force=true\n{\n  \"entity\": {\n    \"id\": \"user:jane.doe@example.com\",\n    \"name\": \"jane.doe\",\n    \"type\": \"user\",\n    \"attributes\": { \"managed\": true, \"mfa_enabled\": true }\n  },\n  \"user\": { \"name\": \"jane.doe\" }\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/entities/bulk:
    put:
      tags:
        - Security entity store
      summary: Bulk update entities
      description: 'Update multiple entity records in the Entity Store in a single request.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store-entities-bulk
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: force
          in: query
          description: 'When true, allows updating protected fields.'
          schema:
            anyOf:
              - enum:
                  - 'true'
                  - 'false'
                type: string
              - type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              required:
                - entities
              type: object
              properties:
                entities:
                  type: array
                  items:
                    required:
                      - type
                    type: object
                    properties:
                      doc:
                        anyOf:
                          - type: object
                            properties:
                              '@timestamp':
                                pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                type: string
                                description: The time the entity record was last updated.
                                format: date-time
                              asset:
                                type: object
                                properties:
                                  business_unit:
                                    type: string
                                    description: Business unit the asset belongs to.
                                  criticality:
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    type:
                                      - 'null'
                                      - string
                                    description: The criticality level assigned to this asset.
                                  environment:
                                    type: string
                                    description: 'Deployment environment (for example, production, staging).'
                                  id:
                                    type: string
                                    description: Unique identifier for the asset.
                                  model:
                                    type: string
                                    description: Model name or number.
                                  name:
                                    type: string
                                    description: Human-readable asset name.
                                  owner:
                                    type: string
                                    description: The owner of the asset.
                                  serial_number:
                                    type: string
                                    description: Serial number of the asset.
                                  vendor:
                                    type: string
                                    description: Vendor or manufacturer.
                                additionalProperties: false
                              entity:
                                type: object
                                properties:
                                  attributes:
                                    type: object
                                    properties:
                                      asset:
                                        type: boolean
                                        description: Whether the entity is classified as an asset.
                                      known_redirects:
                                        type: array
                                        items:
                                          type: string
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                      managed:
                                        type: boolean
                                        description: 'Whether the entity is managed (for example, via a directory service).'
                                      mfa_enabled:
                                        type: boolean
                                        description: Whether multi-factor authentication is enabled for the entity.
                                      oauth_consent_restriction:
                                        type: string
                                        description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                                      permissions:
                                        type: array
                                        items:
                                          type: string
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                      storage_class:
                                        type: string
                                        description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                                      watchlists:
                                        type: array
                                        items:
                                          type: string
                                        description: Watchlist identifiers the entity belongs to (v2).
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                  behaviors:
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        type: array
                                        items:
                                          type: string
                                        description: Machine learning anomaly job identifiers (v2).
                                      rule_names:
                                        type: array
                                        items:
                                          type: string
                                        description: Detection rule names that flagged this entity (v2).
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                  created_by:
                                    type: string
                                    description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                                  EngineMetadata:
                                    type: object
                                    properties:
                                      Type:
                                        type: string
                                        description: The engine type that produced this entity record.
                                    additionalProperties: false
                                  id:
                                    type: string
                                    description: Unique identifier for this entity.
                                  lifecycle:
                                    type: object
                                    properties:
                                      first_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was first observed.
                                        format: date-time
                                      last_activity:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity last generated activity.
                                        format: date-time
                                      last_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was last observed.
                                        format: date-time
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                  name:
                                    type: string
                                    description: Human-readable name of the entity.
                                  relationships:
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                      accesses_infrequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                      administers:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                                      communicates_with:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                      depends_on:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                      owns:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                      owns_inferred:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                      resolution:
                                        type: object
                                        properties:
                                          resolved_to:
                                            type: string
                                            description: entity.id of the entity this one resolves to
                                          risk:
                                            type: object
                                            properties:
                                              calculated_level:
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                                description: Lexical description of the resolution group's aggregated risk.
                                              calculated_score:
                                                type: number
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                              calculated_score_norm:
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                      supervises:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                  schema_version:
                                    type: string
                                    description: Schema version of the entity record.
                                  source:
                                    type: array
                                    items:
                                      type: string
                                    description: Sources that produced this entity record.
                                  sub_type:
                                    type: string
                                    description: Optional sub-type classification for the entity.
                                  type:
                                    type: string
                                    description: The entity type.
                                  url:
                                    type: string
                                    description: URL associated with the entity.
                                additionalProperties: false
                              event:
                                type: object
                                properties:
                                  ingested:
                                    pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                    type: string
                                    description: When the event was ingested into Elasticsearch.
                                    format: date-time
                                additionalProperties: false
                              labels:
                                type: object
                                additionalProperties: { }
                                description: Custom key-value labels attached to the entity.
                              tags:
                                type: array
                                items:
                                  type: string
                                description: Tags attached to the entity.
                              user:
                                type: object
                                properties:
                                  domain:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed user domains.
                                  email:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed email addresses.
                                  full_name:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed full names of the user.
                                  hash:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed user hashes.
                                  id:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed user identifiers.
                                  name:
                                    type: string
                                    description: Primary user name.
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score.
                                    additionalProperties: false
                                  roles:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed roles assigned to the user.
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) user fields collected on the entity.
                            additionalProperties: false
                          - type: object
                            properties:
                              '@timestamp':
                                pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                type: string
                                description: The time the entity record was last updated.
                                format: date-time
                              asset:
                                type: object
                                properties:
                                  business_unit:
                                    type: string
                                    description: Business unit the asset belongs to.
                                  criticality:
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    type:
                                      - 'null'
                                      - string
                                    description: The criticality level assigned to this asset.
                                  environment:
                                    type: string
                                    description: 'Deployment environment (for example, production, staging).'
                                  id:
                                    type: string
                                    description: Unique identifier for the asset.
                                  model:
                                    type: string
                                    description: Model name or number.
                                  name:
                                    type: string
                                    description: Human-readable asset name.
                                  owner:
                                    type: string
                                    description: The owner of the asset.
                                  serial_number:
                                    type: string
                                    description: Serial number of the asset.
                                  vendor:
                                    type: string
                                    description: Vendor or manufacturer.
                                additionalProperties: false
                              entity:
                                type: object
                                properties:
                                  attributes:
                                    type: object
                                    properties:
                                      asset:
                                        type: boolean
                                        description: Whether the entity is classified as an asset.
                                      known_redirects:
                                        type: array
                                        items:
                                          type: string
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                      managed:
                                        type: boolean
                                        description: 'Whether the entity is managed (for example, via a directory service).'
                                      mfa_enabled:
                                        type: boolean
                                        description: Whether multi-factor authentication is enabled for the entity.
                                      oauth_consent_restriction:
                                        type: string
                                        description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                                      permissions:
                                        type: array
                                        items:
                                          type: string
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                      storage_class:
                                        type: string
                                        description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                                      watchlists:
                                        type: array
                                        items:
                                          type: string
                                        description: Watchlist identifiers the entity belongs to (v2).
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                  behaviors:
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        type: array
                                        items:
                                          type: string
                                        description: Machine learning anomaly job identifiers (v2).
                                      rule_names:
                                        type: array
                                        items:
                                          type: string
                                        description: Detection rule names that flagged this entity (v2).
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                  created_by:
                                    type: string
                                    description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                                  EngineMetadata:
                                    type: object
                                    properties:
                                      Type:
                                        type: string
                                        description: The engine type that produced this entity record.
                                    additionalProperties: false
                                  id:
                                    type: string
                                    description: Unique identifier for this entity.
                                  lifecycle:
                                    type: object
                                    properties:
                                      first_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was first observed.
                                        format: date-time
                                      last_activity:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity last generated activity.
                                        format: date-time
                                      last_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was last observed.
                                        format: date-time
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                  name:
                                    type: string
                                    description: Human-readable name of the entity.
                                  relationships:
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                      accesses_infrequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                      administers:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                                      communicates_with:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                      depends_on:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                      owns:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                      owns_inferred:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                      resolution:
                                        type: object
                                        properties:
                                          resolved_to:
                                            type: string
                                            description: entity.id of the entity this one resolves to
                                          risk:
                                            type: object
                                            properties:
                                              calculated_level:
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                                description: Lexical description of the resolution group's aggregated risk.
                                              calculated_score:
                                                type: number
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                              calculated_score_norm:
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                      supervises:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                  schema_version:
                                    type: string
                                    description: Schema version of the entity record.
                                  source:
                                    type: array
                                    items:
                                      type: string
                                    description: Sources that produced this entity record.
                                  sub_type:
                                    type: string
                                    description: Optional sub-type classification for the entity.
                                  type:
                                    type: string
                                    description: The entity type.
                                  url:
                                    type: string
                                    description: URL associated with the entity.
                                additionalProperties: false
                              event:
                                type: object
                                properties:
                                  ingested:
                                    pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                    type: string
                                    description: When the event was ingested into Elasticsearch.
                                    format: date-time
                                additionalProperties: false
                              host:
                                type: object
                                properties:
                                  architecture:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed CPU architectures.
                                  domain:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed host domains.
                                  hostname:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed hostnames.
                                  id:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed host identifiers.
                                  ip:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed IP addresses.
                                  mac:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed MAC addresses.
                                  name:
                                    type: string
                                    description: Primary host name.
                                  os:
                                    type: object
                                    properties:
                                      family:
                                        type: string
                                      full:
                                        type: string
                                      kernel:
                                        type: string
                                      name:
                                        anyOf:
                                          - type: string
                                          - type: array
                                            items:
                                              type: string
                                      platform:
                                        type: string
                                      type:
                                        anyOf:
                                          - type: string
                                          - type: array
                                            items:
                                              type: string
                                      version:
                                        type: string
                                    additionalProperties: false
                                    description: Elastic Common Schema (ECS) host.os fields collected on the entity latest index (v2).
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score.
                                    additionalProperties: false
                                  type:
                                    type: array
                                    items:
                                      type: string
                                    description: Observed host types.
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) host fields collected on the entity.
                              labels:
                                type: object
                                additionalProperties: { }
                                description: Custom key-value labels attached to the entity.
                              tags:
                                type: array
                                items:
                                  type: string
                                description: Tags attached to the entity.
                            additionalProperties: false
                          - type: object
                            properties:
                              '@timestamp':
                                pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                type: string
                                description: The time the entity record was last updated.
                                format: date-time
                              asset:
                                type: object
                                properties:
                                  business_unit:
                                    type: string
                                    description: Business unit the asset belongs to.
                                  criticality:
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    type:
                                      - 'null'
                                      - string
                                    description: The criticality level assigned to this asset.
                                  environment:
                                    type: string
                                    description: 'Deployment environment (for example, production, staging).'
                                  id:
                                    type: string
                                    description: Unique identifier for the asset.
                                  model:
                                    type: string
                                    description: Model name or number.
                                  name:
                                    type: string
                                    description: Human-readable asset name.
                                  owner:
                                    type: string
                                    description: The owner of the asset.
                                  serial_number:
                                    type: string
                                    description: Serial number of the asset.
                                  vendor:
                                    type: string
                                    description: Vendor or manufacturer.
                                additionalProperties: false
                              entity:
                                type: object
                                properties:
                                  attributes:
                                    type: object
                                    properties:
                                      asset:
                                        type: boolean
                                        description: Whether the entity is classified as an asset.
                                      known_redirects:
                                        type: array
                                        items:
                                          type: string
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                      managed:
                                        type: boolean
                                        description: 'Whether the entity is managed (for example, via a directory service).'
                                      mfa_enabled:
                                        type: boolean
                                        description: Whether multi-factor authentication is enabled for the entity.
                                      oauth_consent_restriction:
                                        type: string
                                        description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                                      permissions:
                                        type: array
                                        items:
                                          type: string
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                      storage_class:
                                        type: string
                                        description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                                      watchlists:
                                        type: array
                                        items:
                                          type: string
                                        description: Watchlist identifiers the entity belongs to (v2).
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                  behaviors:
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        type: array
                                        items:
                                          type: string
                                        description: Machine learning anomaly job identifiers (v2).
                                      rule_names:
                                        type: array
                                        items:
                                          type: string
                                        description: Detection rule names that flagged this entity (v2).
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                  created_by:
                                    type: string
                                    description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                                  EngineMetadata:
                                    type: object
                                    properties:
                                      Type:
                                        type: string
                                        description: The engine type that produced this entity record.
                                    additionalProperties: false
                                  id:
                                    type: string
                                    description: Unique identifier for this entity.
                                  lifecycle:
                                    type: object
                                    properties:
                                      first_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was first observed.
                                        format: date-time
                                      last_activity:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity last generated activity.
                                        format: date-time
                                      last_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was last observed.
                                        format: date-time
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                  name:
                                    type: string
                                    description: Human-readable name of the entity.
                                  relationships:
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                      accesses_infrequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                      administers:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                                      communicates_with:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                      depends_on:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                      owns:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                      owns_inferred:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                      resolution:
                                        type: object
                                        properties:
                                          resolved_to:
                                            type: string
                                            description: entity.id of the entity this one resolves to
                                          risk:
                                            type: object
                                            properties:
                                              calculated_level:
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                                description: Lexical description of the resolution group's aggregated risk.
                                              calculated_score:
                                                type: number
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                              calculated_score_norm:
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                      supervises:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                  schema_version:
                                    type: string
                                    description: Schema version of the entity record.
                                  source:
                                    type: array
                                    items:
                                      type: string
                                    description: Sources that produced this entity record.
                                  sub_type:
                                    type: string
                                    description: Optional sub-type classification for the entity.
                                  type:
                                    type: string
                                    description: The entity type.
                                  url:
                                    type: string
                                    description: URL associated with the entity.
                                additionalProperties: false
                              event:
                                type: object
                                properties:
                                  ingested:
                                    pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                    type: string
                                    description: When the event was ingested into Elasticsearch.
                                    format: date-time
                                additionalProperties: false
                              labels:
                                type: object
                                additionalProperties: { }
                                description: Custom key-value labels attached to the entity.
                              service:
                                type: object
                                properties:
                                  address:
                                    type: string
                                    description: Service address.
                                  environment:
                                    type: string
                                    description: 'Service environment (for example, production, staging).'
                                  ephemeral_id:
                                    type: string
                                    description: Ephemeral identifier of the service.
                                  id:
                                    type: string
                                    description: Unique identifier of the service.
                                  name:
                                    type: string
                                    description: Primary service name.
                                  node:
                                    type: object
                                    properties:
                                      name:
                                        type: string
                                        description: Node name.
                                      role:
                                        type: string
                                        description: Node role.
                                      roles:
                                        type: array
                                        items:
                                          type: string
                                        description: Node roles.
                                    additionalProperties: false
                                    description: Node information for the service.
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score.
                                    additionalProperties: false
                                  state:
                                    type: string
                                    description: Current state of the service.
                                  type:
                                    type: string
                                    description: Service type.
                                  version:
                                    type: string
                                    description: Service version.
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) service fields collected on the entity.
                              tags:
                                type: array
                                items:
                                  type: string
                                description: Tags attached to the entity.
                            additionalProperties: false
                          - type: object
                            properties:
                              '@timestamp':
                                pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                type: string
                                description: The time the entity record was last updated.
                                format: date-time
                              asset:
                                type: object
                                properties:
                                  business_unit:
                                    type: string
                                    description: Business unit the asset belongs to.
                                  criticality:
                                    enum:
                                      - low_impact
                                      - medium_impact
                                      - high_impact
                                      - extreme_impact
                                    type:
                                      - 'null'
                                      - string
                                    description: The criticality level assigned to this asset.
                                  environment:
                                    type: string
                                    description: 'Deployment environment (for example, production, staging).'
                                  id:
                                    type: string
                                    description: Unique identifier for the asset.
                                  model:
                                    type: string
                                    description: Model name or number.
                                  name:
                                    type: string
                                    description: Human-readable asset name.
                                  owner:
                                    type: string
                                    description: The owner of the asset.
                                  serial_number:
                                    type: string
                                    description: Serial number of the asset.
                                  vendor:
                                    type: string
                                    description: Vendor or manufacturer.
                                additionalProperties: false
                              cloud:
                                type: object
                                properties:
                                  account:
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                    additionalProperties: false
                                  availability_zone:
                                    type: string
                                  instance:
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                    additionalProperties: false
                                  machine:
                                    type: object
                                    properties:
                                      type:
                                        type: string
                                    additionalProperties: false
                                  project:
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                    additionalProperties: false
                                  provider:
                                    type: string
                                  region:
                                    type: string
                                  service:
                                    type: object
                                    properties:
                                      name:
                                        type: string
                                    additionalProperties: false
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) cloud fields for cloud-hosted entities.
                              entity:
                                type: object
                                properties:
                                  attributes:
                                    type: object
                                    properties:
                                      asset:
                                        type: boolean
                                        description: Whether the entity is classified as an asset.
                                      known_redirects:
                                        type: array
                                        items:
                                          type: string
                                        description: Known redirect URIs or URLs (e.g. OAuth application callbacks).
                                      managed:
                                        type: boolean
                                        description: 'Whether the entity is managed (for example, via a directory service).'
                                      mfa_enabled:
                                        type: boolean
                                        description: Whether multi-factor authentication is enabled for the entity.
                                      oauth_consent_restriction:
                                        type: string
                                        description: 'OAuth consent restriction (e.g. admin_only, verified_only, unrestricted).'
                                      permissions:
                                        type: array
                                        items:
                                          type: string
                                        description: Action-level permissions granted to this entity (not roles or groups).
                                      storage_class:
                                        type: string
                                        description: 'Storage tier or class assigned to a storage resource (e.g. hot, warm, cold, standard, archive).'
                                      watchlists:
                                        type: array
                                        items:
                                          type: string
                                        description: Watchlist identifiers the entity belongs to (v2).
                                    additionalProperties: false
                                    description: Boolean flags describing characteristics of the entity.
                                  behaviors:
                                    type: object
                                    properties:
                                      anomaly_job_ids:
                                        type: array
                                        items:
                                          type: string
                                        description: Machine learning anomaly job identifiers (v2).
                                      rule_names:
                                        type: array
                                        items:
                                          type: string
                                        description: Detection rule names that flagged this entity (v2).
                                    additionalProperties: false
                                    description: Behavioral signals observed for the entity.
                                  created_by:
                                    type: string
                                    description: 'Identifies which engine created this entity (for example, logs_extraction or risk_score_maintainer).'
                                  EngineMetadata:
                                    type: object
                                    properties:
                                      Type:
                                        type: string
                                        description: The engine type that produced this entity record.
                                    additionalProperties: false
                                  id:
                                    type: string
                                    description: Unique identifier for this entity.
                                  lifecycle:
                                    type: object
                                    properties:
                                      first_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was first observed.
                                        format: date-time
                                      last_activity:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity last generated activity.
                                        format: date-time
                                      last_seen:
                                        pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                        type: string
                                        description: When the entity was last observed.
                                        format: date-time
                                    additionalProperties: false
                                    description: Timestamps tracking the entity lifecycle.
                                  name:
                                    type: string
                                    description: Human-readable name of the entity.
                                  relationships:
                                    type: object
                                    properties:
                                      accesses_frequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses frequently.
                                      accesses_infrequently:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity accesses infrequently.
                                      administers:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: 'Entities this entity administers (for example, a user who is an admin of a service).'
                                      communicates_with:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity communicates with.
                                      depends_on:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities this entity depends on.
                                      owns:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities owned by this entity.
                                      owns_inferred:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities inferred to be owned by this entity.
                                      resolution:
                                        type: object
                                        properties:
                                          resolved_to:
                                            type: string
                                            description: entity.id of the entity this one resolves to
                                          risk:
                                            type: object
                                            properties:
                                              calculated_level:
                                                enum:
                                                  - Unknown
                                                  - Low
                                                  - Moderate
                                                  - High
                                                  - Critical
                                                type: string
                                                description: Lexical description of the resolution group's aggregated risk.
                                              calculated_score:
                                                type: number
                                                description: The raw numeric value of the resolution group's aggregated risk score.
                                              calculated_score_norm:
                                                maximum: 100
                                                minimum: 0
                                                type: number
                                                description: The normalized numeric value of the resolution group's aggregated risk score.
                                            additionalProperties: false
                                            description: Aggregated risk score for the resolution group.
                                        additionalProperties: false
                                        description: Resolution metadata linking this entity to another.
                                      supervises:
                                        type: object
                                        properties:
                                          ids:
                                            type: array
                                            items:
                                              type: string
                                            description: Target entity EUIDs for this relationship; used for graph LOOKUP JOIN and DSL filters.
                                          raw_identifiers:
                                            type: object
                                            properties:
                                              entity.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.id:
                                                type: array
                                                items:
                                                  type: string
                                              host.name:
                                                type: array
                                                items:
                                                  type: string
                                              service.name:
                                                type: array
                                                items:
                                                  type: string
                                              user.email:
                                                type: array
                                                items:
                                                  type: string
                                              user.id:
                                                type: array
                                                items:
                                                  type: string
                                              user.name:
                                                type: array
                                                items:
                                                  type: string
                                            additionalProperties: false
                                        additionalProperties: false
                                        description: Entities supervised by this entity.
                                    additionalProperties: false
                                    description: Connections between this entity and other entities.
                                  risk:
                                    type: object
                                    properties:
                                      calculated_level:
                                        enum:
                                          - Unknown
                                          - Low
                                          - Moderate
                                          - High
                                          - Critical
                                        type: string
                                        description: Lexical description of the entity's risk.
                                      calculated_score:
                                        type: number
                                        description: The raw numeric value of the given entity's risk score.
                                      calculated_score_norm:
                                        maximum: 100
                                        minimum: 0
                                        type: number
                                        description: The normalized numeric value of the given entity's risk score. Useful for comparing with other entities.
                                    additionalProperties: false
                                    description: Risk scoring information for the entity.
                                  schema_version:
                                    type: string
                                    description: Schema version of the entity record.
                                  source:
                                    type: array
                                    items:
                                      type: string
                                    description: Sources that produced this entity record.
                                  sub_type:
                                    type: string
                                    description: Optional sub-type classification for the entity.
                                  type:
                                    type: string
                                    description: The entity type.
                                  url:
                                    type: string
                                    description: URL associated with the entity.
                                additionalProperties: false
                              event:
                                type: object
                                properties:
                                  ingested:
                                    pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
                                    type: string
                                    format: date-time
                                additionalProperties: false
                              labels:
                                type: object
                                additionalProperties: { }
                              orchestrator:
                                type: object
                                properties:
                                  api_version:
                                    type: string
                                  cluster:
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      name:
                                        type: string
                                      url:
                                        type: string
                                      version:
                                        type: string
                                    additionalProperties: false
                                  namespace:
                                    type: string
                                  organization:
                                    type: string
                                  resource:
                                    type: object
                                    properties:
                                      annotation:
                                        type: string
                                      id:
                                        type: string
                                      ip:
                                        type: string
                                      label:
                                        type: string
                                      name:
                                        type: string
                                      parent:
                                        type: object
                                        properties:
                                          type:
                                            type: string
                                        additionalProperties: false
                                      type:
                                        type: string
                                    additionalProperties: false
                                  type:
                                    type: string
                                additionalProperties: false
                                description: Elastic Common Schema (ECS) orchestrator fields for container-orchestrated entities.
                              tags:
                                type: array
                                items:
                                  type: string
                            additionalProperties: false
                      type:
                        enum:
                          - user
                          - host
                          - service
                          - generic
                        type: string
                        description: The entity type of this record.
                  description: The entities to update.
              additionalProperties: false
            examples:
              bulkUpdateExample:
                summary: Bulk update multiple entities
                description: Update a host entity and a user entity in a single request.
                value:
                  entities:
                    - doc:
                        entity:
                          attributes:
                            asset: true
                          id: host:web-server-prod-01
                          name: web-server-prod-01
                          type: host
                        host:
                          name: web-server-prod-01
                      type: host
                    - doc:
                        entity:
                          attributes:
                            managed: true
                          id: user:jane.doe@example.com
                          name: jane.doe
                          type: user
                        user:
                          name: jane.doe
                      type: user
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                bulkUpdatePartialExample:
                  summary: Partial success with errors
                  description: Some entities were updated but others encountered Elasticsearch-level errors.
                  value:
                    errors:
                      - _id: 5de9f93a68a72532e736bf5a6184b06300b9cabf
                        reason: '[5de9f93a68a72532e736bf5a6184b06300b9cabf]: document missing'
                        status: 404
                        type: document_missing_exception
                    ok: true
                bulkUpdateSuccessExample:
                  summary: All entities updated
                  description: All entities were successfully updated with no errors.
                  value:
                    errors: [ ]
                    ok: true
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                protectedFieldsExample:
                  summary: Protected fields without force
                  description: The request attempts to update protected fields without the force query parameter.
                  value:
                    error: Bad Request
                    message: 'Bad request: The following attributes are not allowed to be updated without forcing it (?force=true): entity.name, entity.type'
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entities\":[{\"type\":\"host\",\"doc\":{\"entity\":{\"id\":\"host:web-server-prod-01\",\"name\":\"web-server-prod-01\",\"type\":\"host\",\"attributes\":{\"asset\":true}},\"host\":{\"name\":\"web-server-prod-01\"}}}]}' \\\n  \"${KIBANA_URL}/api/security/entity_store/entities/bulk?force=true\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store/entities/bulk?force=true\n{\n  \"entities\": [\n    {\n      \"type\": \"host\",\n      \"doc\": {\n        \"entity\": {\n          \"id\": \"host:web-server-prod-01\",\n          \"name\": \"web-server-prod-01\",\n          \"type\": \"host\",\n          \"attributes\": { \"asset\": true }\n        },\n        \"host\": { \"name\": \"web-server-prod-01\" }\n      }\n    }\n  ]\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/history_snapshot/disable:
    put:
      tags:
        - Security entity store
      summary: Disable the history snapshot task
      description: 'Disable the Entity Store history snapshot task for this space so it no longer creates snapshot indices. Existing snapshot indices remain unless you set `clearHistorySnapshots` to `true`. Returns 404 if the Entity Store is not installed in the current space.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store-history-snapshot-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                clearHistorySnapshots:
                  type: boolean
                  description: 'When `true`, deletes existing history snapshot indices for this space in the background after the task is disabled. The response returns immediately and does not wait for deletion to finish. Deletion failures are logged and are not returned to the caller. If the task is already disabled, the request succeeds and does not delete indices. Defaults to `false`.'
                  default: false
              additionalProperties: false
            examples:
              disableAndClear:
                summary: Disable and clear snapshot indices
                value:
                  clearHistorySnapshots: true
              disableOnly:
                summary: Disable without clearing
                value: { }
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                disableSuccessExample:
                  summary: History snapshot task disabled
                  description: The Entity Store history snapshot task was disabled.
                  value:
                    ok: true
        '404':
          description: Entity store is not installed.
          content:
            application/json:
              examples:
                notInstalledExample:
                  summary: Entity store not installed
                  description: The Entity Store history snapshot task cannot be disabled because the entity store is not installed.
                  value:
                    error: Not Found
                    message: Entity store is not installed
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Content-Type: application/json\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -d '{}' \\\n  \"${KIBANA_URL}/api/security/entity_store/history_snapshot/disable\"\n"
        - label: Disable and clear indices
          lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Content-Type: application/json\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -d '{\"clearHistorySnapshots\":true}' \\\n  \"${KIBANA_URL}/api/security/entity_store/history_snapshot/disable\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store/history_snapshot/disable\n{}\n"
        - label: Disable and clear indices
          lang: Console
          source: "PUT kbn://api/security/entity_store/history_snapshot/disable\n{\n  \"clearHistorySnapshots\": true\n}\n"
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/history_snapshot/enable:
    put:
      tags:
        - Security entity store
      summary: Enable the history snapshot task
      description: 'Enable the Entity Store history snapshot task for this space. After a successful enable, Kibana schedules an immediate snapshot run. If that immediate run fails, the response is still 200 and the task remains enabled for the next scheduled interval. If the task is already enabled, the request succeeds and does not start an extra run. Returns 404 if the Entity Store is not installed in the current space.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store-history-snapshot-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                enableSuccessExample:
                  summary: History snapshot task enabled
                  description: The Entity Store history snapshot task was enabled.
                  value:
                    ok: true
        '404':
          description: Entity store is not installed.
          content:
            application/json:
              examples:
                notInstalledExample:
                  summary: Entity store not installed
                  description: The Entity Store history snapshot task cannot be enabled because the entity store is not installed.
                  value:
                    error: Not Found
                    message: Entity store is not installed
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  \"${KIBANA_URL}/api/security/entity_store/history_snapshot/enable\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store/history_snapshot/enable\n"
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/install:
    post:
      tags:
        - Security entity store
      summary: Install the Entity Store
      description: 'Install the Entity Store and create engines for the specified entity types. A single `logExtraction` configuration is shared across all entity types. Supply it once at install to customize settings; omit it (or send an empty object) to use defaults on first install or preserve the existing configuration on re-install. Omitting a field leaves it unchanged. Sending `null` for a field clears that override and reverts to the default value. To change settings after install, use the update endpoint.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: post-security-entity-store-install
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entityTypes:
                  type: array
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  default:
                    - user
                    - host
                    - service
                    - generic
                historySnapshot:
                  type: object
                  properties:
                    frequency:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type: string
                      default: 24h
                  additionalProperties: false
                logExtraction:
                  type: object
                  properties:
                    additionalIndexPatterns:
                      maxItems: 1000
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 2048
                        type: string
                    delay:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                    docsLimit:
                      maximum: 9007199254740991
                      minimum: 1
                      type:
                        - 'null'
                        - integer
                    excludedIndexPatterns:
                      maxItems: 1000
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 2048
                        type: string
                    fieldHistoryLength:
                      maximum: 9007199254740991
                      minimum: -9007199254740991
                      type:
                        - 'null'
                        - integer
                    frequency:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                    lookbackPeriod:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                    maxLogsPerPage:
                      maximum: 9007199254740991
                      minimum: 1
                      type:
                        - 'null'
                        - integer
                    maxLogsPerWindow:
                      maximum: 9007199254740991
                      minimum: 0
                      type:
                        - 'null'
                        - integer
                    maxLogsPerWindowCapBehavior:
                      enum:
                        - defer
                        - drop
                      type:
                        - 'null'
                        - string
                    maxTimeWindowSize:
                      maxLength: 32
                      pattern: '[smdh]$'
                      type:
                        - 'null'
                        - string
                  additionalProperties: false
              additionalProperties: false
            examples:
              installDefaultExample:
                summary: Install with default entity types
                description: Install the Entity Store for all entity types with default log extraction settings.
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
                  logExtraction: { }
              installWithCustomSettingsExample:
                summary: Install with custom log extraction
                description: Install the Entity Store for host entities only with a custom lookback period and field history length.
                value:
                  entityTypes:
                    - host
                  logExtraction:
                    delay: 2m
                    fieldHistoryLength: 20
                    frequency: 5m
                    lookbackPeriod: 12h
      responses:
        '200':
          description: Indicates all requested entity types are already installed.
          content:
            application/json:
              examples:
                alreadyInstalledExample:
                  summary: Already installed
                  description: All requested entity types were already installed.
                  value:
                    ok: true
        '201':
          description: Indicates the Entity Store was successfully installed.
          content:
            application/json:
              examples:
                installSuccessExample:
                  summary: Entity Store installed
                  description: The Entity Store was installed and engines are being created.
                  value:
                    ok: true
        '403':
          description: Insufficient privileges.
          content:
            application/json:
              examples:
                forbiddenExample:
                  summary: Insufficient privileges
                  description: The user does not have the required Elasticsearch privileges.
                  value:
                    error: Forbidden
                    message: User 'analyst' has insufficient privileges
                    statusCode: 403
      x-codeSamples:
        - lang: curl
          source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"],\"logExtraction\":{}}' \\\n  \"${KIBANA_URL}/api/security/entity_store/install\"\n"
        - lang: Console
          source: "POST kbn://api/security/entity_store/install\n{\n  \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"],\n  \"logExtraction\": {}\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/group:
    get:
      tags:
        - Security entity store
      summary: Get resolution group
      description: 'Get the resolution group for a given entity, returning all linked entities.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
      operationId: get-security-entity-store-resolution-group
      parameters:
        - name: entity_id
          in: query
          description: The entity identifier to look up the resolution group for.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                resolutionGroupExample:
                  summary: Resolution group with linked entities
                  description: 'Returns the resolution group for an entity, including the target entity, all aliases, and the group size.'
                  value:
                    aliases:
                      - '@timestamp': '2026-04-10T08:25:00.000Z'
                        entity:
                          id: user:jdoe@example.com
                          name: jdoe
                          relationships:
                            resolution:
                              resolved_to: user:jane.doe@example.com
                          type: user
                        user:
                          name: jdoe
                    entity_type: user
                    group_size: 2
                    target:
                      '@timestamp': '2026-04-10T08:30:00.000Z'
                      entity:
                        id: user:jane.doe@example.com
                        name: jane.doe
                        type: user
                      user:
                        email:
                          - jane.doe@example.com
                        name: jane.doe
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                truncatedSearchExample:
                  summary: Search results truncated
                  description: The resolution search returned too many results and was truncated.
                  value:
                    error: Bad Request
                    message: Resolution search truncated
                    statusCode: 400
        '404':
          description: Entity not found.
          content:
            application/json:
              examples:
                notFoundExample:
                  summary: Entity not found
                  description: The specified entity does not exist or has no resolution group.
                  value:
                    error: Not Found
                    message: 'Entities not found: [user:nonexistent@example.com]'
                    statusCode: 404
      x-codeSamples:
        - lang: curl
          source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n  \"${KIBANA_URL}/api/security/entity_store/resolution/group?entity_id=user%3Ajane.doe%40example.com\"\n"
        - lang: Console
          source: "GET kbn://api/security/entity_store/resolution/group?entity_id=user:jane.doe@example.com\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/link:
    post:
      tags:
        - Security entity store
      summary: Link entities
      description: 'Link one or more entities to a target entity, creating a resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
      operationId: post-security-entity-store-resolution-link
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - target_id
                - entity_ids
              type: object
              properties:
                entity_ids:
                  maxItems: 1000
                  minItems: 1
                  type: array
                  items:
                    type: string
                  description: 'Entity identifiers to link to the target entity. Minimum 1, maximum 1000.'
                target_id:
                  type: string
                  description: The entity identifier to resolve the linked entities to.
              additionalProperties: false
            examples:
              linkEntitiesExample:
                summary: Link entities to a target
                description: 'Link two user entities to a target entity, creating a resolution group.'
                value:
                  entity_ids:
                    - user:jdoe@example.com
                    - user:j.doe@example.com
                  target_id: user:jane.doe@example.com
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                linkSuccessExample:
                  summary: Entities linked
                  description: The entities were successfully linked to the target entity.
                  value:
                    entity_type: user
                    linked:
                      - user:jdoe@example.com
                      - user:j.doe@example.com
                    skipped: [ ]
                    target_id: user:jane.doe@example.com
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                mixedTypesExample:
                  summary: Mixed entity types
                  description: All entities in a resolution group must be of the same type.
                  value:
                    error: Bad Request
                    message: Cannot link entities of different types
                    statusCode: 400
                notFoundExample:
                  summary: Entities not found
                  description: One or more of the specified entity identifiers were not found.
                  value:
                    error: Bad Request
                    message: 'Entities not found: [user:nonexistent@example.com, user:also-nonexistent@example.com]'
                    statusCode: 400
                selfLinkExample:
                  summary: Self-link error
                  description: Cannot link an entity to itself.
                  value:
                    error: Bad Request
                    message: Cannot link entity 'user:jane.doe@example.com' to itself.
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"target_id\":\"user:jane.doe@example.com\",\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n  \"${KIBANA_URL}/api/security/entity_store/resolution/link\"\n"
        - lang: Console
          source: "POST kbn://api/security/entity_store/resolution/link\n{\n  \"target_id\": \"user:jane.doe@example.com\",\n  \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/rules:
    get:
      tags:
        - Security entity store
      summary: List entity resolution rules
      description: 'List managed entity resolution rules and their effective enabled state for this space. Each rule description states what it bridges, which data sources it needs, and when to disable it.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
      operationId: get-security-entity-store-resolution-rules
      responses:
        '200':
          description: Entity resolution rules.
          content:
            application/json:
              examples:
                rulesListExample:
                  summary: Managed resolution rules
                  description: Lists the managed resolution rules and their enabled state in the current space.
                  value:
                    rules:
                      - description: 'Links user entities that share the same email address, compared case-insensitively, across identity providers. Disable if shared mailboxes or role accounts produce false links.'
                        enabled: true
                        id: email_exact_match
                        kind: same_field
                        managed: true
                      - description: 'Links Windows and system account-management (IAM) entities to Active Directory by SID (`user.id`), excluding well-known SIDs such as LocalSystem. Needs Windows/system IAM events and Active Directory entity analytics. Disable if well-known SID exclusions are not enough for your environment.'
                        enabled: true
                        id: windows_sid_bridge
                        kind: same_field
                        managed: true
                      - description: Links Microsoft Defender (`m365_defender`) identities to Entra ID by GUID-shaped `user.id`. Needs Defender identity events and Entra entity analytics. Disable if Defender SID IAM events leak through the GUID gate.
                        enabled: true
                        id: entra_guid_bridge
                        kind: same_field
                        managed: true
                      - description: Links CrowdStrike user entities to Active Directory by SID-prefixed `user.id` (filters out Linux UIDs). Needs CrowdStrike FDR IAM events and Active Directory entity analytics. Disable if CrowdStrike SID coverage is noisy in your tenant.
                        enabled: true
                        id: crowdstrike_sid_bridge
                        kind: same_field
                        managed: true
                      - description: 'Links Microsoft 365 audit actors (`user.id` UPN) to Entra users (`user.name` UPN), compared case-insensitively. Needs o365 audit user-lifecycle events and Entra entity analytics. Covers admins who perform AAD user operations; disable if that population should stay separate.'
                        enabled: true
                        id: upn_cross_field_bridge
                        kind: cross_field
                        managed: true
                      - description: Related user alias resolution across identity providers
                        enabled: false
                        id: related_user_alias_resolution
                        kind: related_user_alias_resolution
                        managed: true
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security/entity_store/resolution/rules/{id}/disable':
    put:
      tags:
        - Security entity store
      summary: Disable an entity resolution rule
      description: 'Disable a managed entity resolution rule in this space.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
      operationId: put-security-entity-store-resolution-rules-id-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The stable identifier of the entity resolution rule.
          required: true
          schema:
            maxLength: 100
            type: string
      responses:
        '200':
          description: Updated entity resolution rule.
          content:
            application/json:
              examples:
                ruleDisabledExample:
                  summary: Rule disabled
                  description: The related user alias resolution rule was disabled in the current space.
                  value:
                    description: Related user alias resolution across identity providers
                    enabled: false
                    id: related_user_alias_resolution
                    kind: related_user_alias_resolution
                    managed: true
        '404':
          description: Unknown entity resolution rule.
          content:
            application/json:
              examples:
                notFoundExample:
                  summary: Unknown rule
                  description: The requested entity resolution rule does not exist.
                  value:
                    error: Not Found
                    message: 'Saved object [entity-resolution-rule/unknown] not found'
                    statusCode: 404
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security/entity_store/resolution/rules/{id}/enable':
    put:
      tags:
        - Security entity store
      summary: Enable an entity resolution rule
      description: 'Enable a managed entity resolution rule in this space.<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
      operationId: put-security-entity-store-resolution-rules-id-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The stable identifier of the entity resolution rule.
          required: true
          schema:
            maxLength: 100
            type: string
      responses:
        '200':
          description: Updated entity resolution rule.
          content:
            application/json:
              examples:
                ruleEnabledExample:
                  summary: Rule enabled
                  description: The related user alias resolution rule was enabled in the current space.
                  value:
                    description: Related user alias resolution across identity providers
                    enabled: true
                    id: related_user_alias_resolution
                    kind: related_user_alias_resolution
                    managed: true
        '404':
          description: Unknown entity resolution rule.
          content:
            application/json:
              examples:
                notFoundExample:
                  summary: Unknown rule
                  description: The requested entity resolution rule does not exist.
                  value:
                    error: Not Found
                    message: 'Saved object [entity-resolution-rule/unknown] not found'
                    statusCode: 404
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/resolution/unlink:
    post:
      tags:
        - Security entity store
      summary: Unlink entities
      description: 'Remove one or more entities from their resolution group. Changes become visible on subsequent reads after the next index refresh (typically <1s).<br/><br/>[Required authorization] Route required privileges: securitySolution AND securitySolution-entity-analytics.'
      operationId: post-security-entity-store-resolution-unlink
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - entity_ids
              type: object
              properties:
                entity_ids:
                  maxItems: 1000
                  minItems: 1
                  type: array
                  items:
                    type: string
                  description: 'Entity identifiers to unlink from their resolution group. Minimum 1, maximum 1000.'
              additionalProperties: false
            examples:
              unlinkEntitiesExample:
                summary: Unlink entities from their resolution group
                description: 'Remove entities from their resolution group, restoring them as standalone entities.'
                value:
                  entity_ids:
                    - user:jdoe@example.com
                    - user:j.doe@example.com
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                unlinkSuccessExample:
                  summary: Entities unlinked
                  description: The entities were successfully removed from their resolution group.
                  value:
                    entity_type: user
                    skipped: [ ]
                    unlinked:
                      - user:jdoe@example.com
                      - user:j.doe@example.com
        '400':
          description: Bad request.
          content:
            application/json:
              examples:
                mixedTypesExample:
                  summary: Mixed entity types
                  description: All entities in a resolution group must be of the same type.
                  value:
                    error: Bad Request
                    message: 'All entities must be of the same type. Found types: [user, host]'
                    statusCode: 400
                notFoundExample:
                  summary: Entities not found
                  description: One or more of the specified entity identifiers were not found.
                  value:
                    error: Bad Request
                    message: 'Entities not found: [user:nonexistent@example.com]'
                    statusCode: 400
      x-codeSamples:
        - lang: curl
          source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entity_ids\":[\"user:jdoe@example.com\"]}' \\\n  \"${KIBANA_URL}/api/security/entity_store/resolution/unlink\"\n"
        - lang: Console
          source: "POST kbn://api/security/entity_store/resolution/unlink\n{\n  \"entity_ids\": [\"user:jdoe@example.com\"]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/start:
    put:
      tags:
        - Security entity store
      summary: Start Entity Store engines
      description: 'Start previously stopped entity engines, resuming data processing for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store-start
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entityTypes:
                  type: array
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  description: Entity types to start. Defaults to all installed types.
                  default:
                    - user
                    - host
                    - service
                    - generic
              additionalProperties: false
            examples:
              startAllExample:
                summary: Start all entity engines
                description: Start all stopped entity engines.
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
              startSingleExample:
                summary: Start a single entity engine
                description: Start only the host entity engine.
                value:
                  entityTypes:
                    - host
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                startSuccessExample:
                  summary: Engines started
                  description: The specified entity engines were successfully started.
                  value:
                    ok: true
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n  \"${KIBANA_URL}/api/security/entity_store/start\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store/start\n{\n  \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/status:
    get:
      tags:
        - Security entity store
      summary: Get Entity Store status
      description: 'Get the overall Entity Store status and per-engine statuses, optionally including component-level health details.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: get-security-entity-store-status
      parameters:
        - name: include_components
          in: query
          description: 'If true, returns a detailed status of each engine including all its components.'
          schema:
            anyOf:
              - enum:
                  - 'true'
                  - 'false'
                type: string
              - type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                notInstalledExample:
                  summary: Entity Store not installed
                  description: The Entity Store has not been installed.
                  value:
                    engines: [ ]
                    status: not_installed
                runningStatusExample:
                  summary: Entity Store running
                  description: The Entity Store is running with two started engines using default settings.
                  value:
                    engines:
                      - delay: 1m
                        docsPerSecond: -1
                        enrichPolicyExecutionInterval: 'null'
                        fieldHistoryLength: 10
                        filter: ''
                        frequency: 30s
                        indexPattern: ''
                        lastExecutionTimestamp: '2026-04-10T08:30:00.000Z'
                        lookbackPeriod: 3h
                        maxLogsPerPage: 40000
                        maxLogsPerWindow: 500000
                        maxLogsPerWindowCapBehavior: defer
                        maxPageSearchSize: 10000
                        maxTimeWindowSize: 15m
                        status: started
                        timeout: 25s
                        timestampField: '@timestamp'
                        type: host
                      - delay: 1m
                        docsPerSecond: -1
                        enrichPolicyExecutionInterval: 'null'
                        fieldHistoryLength: 10
                        filter: ''
                        frequency: 30s
                        indexPattern: ''
                        lastExecutionTimestamp: '2026-04-10T08:30:00.000Z'
                        lookbackPeriod: 3h
                        maxLogsPerPage: 40000
                        maxLogsPerWindow: 500000
                        maxLogsPerWindowCapBehavior: defer
                        maxPageSearchSize: 10000
                        maxTimeWindowSize: 15m
                        status: started
                        timeout: 25s
                        timestampField: '@timestamp'
                        type: user
                    status: running
      x-codeSamples:
        - lang: curl
          source: "curl -X GET -H \"Authorization: ApiKey ${API_KEY}\" \\\n  \"${KIBANA_URL}/api/security/entity_store/status?include_components=false\"\n"
        - lang: Console
          source: "GET kbn://api/security/entity_store/status?include_components=false\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/stop:
    put:
      tags:
        - Security entity store
      summary: Stop Entity Store engines
      description: 'Stop running entity engines, pausing data processing for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: put-security-entity-store-stop
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entityTypes:
                  type: array
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  description: Entity types to stop. Defaults to all running types.
                  default:
                    - user
                    - host
                    - service
                    - generic
              additionalProperties: false
            examples:
              stopAllExample:
                summary: Stop all entity engines
                description: Stop all running entity engines.
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                stopSuccessExample:
                  summary: Engines stopped
                  description: The specified entity engines were successfully stopped.
                  value:
                    ok: true
      x-codeSamples:
        - lang: curl
          source: "curl -X PUT -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n  \"${KIBANA_URL}/api/security/entity_store/stop\"\n"
        - lang: Console
          source: "PUT kbn://api/security/entity_store/stop\n{\n  \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/entity_store/uninstall:
    post:
      tags:
        - Security entity store
      summary: Uninstall the Entity Store
      description: 'Uninstall the Entity Store, removing engines and associated resources for the specified entity types.<br/><br/>[Required authorization] Route required privileges: securitySolution.'
      operationId: post-security-entity-store-uninstall
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                entityTypes:
                  type: array
                  items:
                    enum:
                      - user
                      - host
                      - service
                      - generic
                    type: string
                  description: Entity types to uninstall. Defaults to all installed types.
                  default:
                    - user
                    - host
                    - service
                    - generic
              additionalProperties: false
            examples:
              uninstallAllExample:
                summary: Uninstall all entity types
                description: Uninstall all entity engines from the Entity Store.
                value:
                  entityTypes:
                    - user
                    - host
                    - service
                    - generic
              uninstallSingleExample:
                summary: Uninstall a single entity type
                description: Uninstall only the host engine from the Entity Store.
                value:
                  entityTypes:
                    - host
      responses:
        '200':
          description: Indicates a successful response.
          content:
            application/json:
              examples:
                uninstallSuccessExample:
                  summary: Entity Store uninstalled
                  description: The specified entity engines were successfully uninstalled.
                  value:
                    ok: true
      x-codeSamples:
        - lang: curl
          source: "curl -X POST -H \"kbn-xsrf: true\" -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"entityTypes\":[\"user\",\"host\",\"service\",\"generic\"]}' \\\n  \"${KIBANA_URL}/api/security/entity_store/uninstall\"\n"
        - lang: Console
          source: "POST kbn://api/security/entity_store/uninstall\n{\n  \"entityTypes\": [\"user\", \"host\", \"service\", \"generic\"]\n}\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/role:
    get:
      tags:
        - roles
      summary: Get all roles
      description: Retrieve all Kibana roles.
      operationId: get-security-role
      parameters:
        - name: replaceDeprecatedPrivileges
          in: query
          description: 'If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.'
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_response'
              examples:
                getAllRolesResponse:
                  value:
                    - _unrecognized_applications: [ ]
                      description: My custom Kibana role.
                      elasticsearch:
                        cluster:
                          - monitor
                        indices:
                          - names:
                              - logs-*
                            privileges:
                              - read
                        run_as: [ ]
                      kibana:
                        - base:
                            - read
                          feature: { }
                          spaces:
                            - default
                      metadata: { }
                      name: my_kibana_role
                      transient_metadata:
                        enabled: true
                getRolesResponse1:
                  $ref: '#/components/examples/get_roles_response1'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/role/_query:
    post:
      summary: Query roles
      description: 'Query Kibana roles with optional filters, paging, and sorting.'
      operationId: post-security-role-query
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_body'
            examples:
              queryRolesRequest:
                value:
                  from: 0
                  query: kibana
                  size: 25
                  sort:
                    direction: asc
                    field: name
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_response'
              examples:
                queryRolesResponse:
                  value:
                    count: 1
                    roles:
                      - _unrecognized_applications: [ ]
                        description: My custom Kibana role.
                        elasticsearch:
                          cluster:
                            - monitor
                          indices:
                            - names:
                                - logs-*
                              privileges:
                                - read
                          run_as: [ ]
                        kibana:
                          - base:
                              - read
                            feature: { }
                            spaces:
                              - default
                        metadata: { }
                        name: my_kibana_role
                        transient_metadata:
                          enabled: true
                    total: 1
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/security/role/{name}':
    delete:
      tags:
        - roles
      summary: Delete a role
      description: Delete a Kibana role by its name.
      operationId: delete-security-role-name
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The role name.
          required: true
          schema:
            minLength: 1
            type: string
      responses:
        '204':
          description: Indicates a successful call.
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - roles
      summary: Get a role
      description: Retrieve a Kibana role by its name.
      operationId: get-security-role-name
      parameters:
        - name: name
          in: path
          description: The role name.
          required: true
          schema:
            minLength: 1
            type: string
        - name: replaceDeprecatedPrivileges
          in: query
          description: 'If `true` and the response contains any privileges that are associated with deprecated features, they are omitted in favor of details about the appropriate replacement feature privileges.'
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_response'
              examples:
                getRoleResponse:
                  value:
                    _unrecognized_applications: [ ]
                    description: My custom Kibana role.
                    elasticsearch:
                      cluster:
                        - monitor
                      indices:
                        - names:
                            - logs-*
                          privileges:
                            - read
                      run_as: [ ]
                    kibana:
                      - base:
                          - read
                        feature: { }
                        spaces:
                          - default
                    metadata: { }
                    name: my_kibana_role
                    transient_metadata:
                      enabled: true
                getRoleResponse1:
                  $ref: '#/components/examples/get_role_response1'
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - roles
      summary: Create or update a role
      description: Create a new Kibana role or update the attributes of an existing role. Kibana roles are stored in the Elasticsearch native realm.
      operationId: put-security-role-name
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The role name.
          required: true
          schema:
            maxLength: 1024
            minLength: 1
            type: string
        - name: createOnly
          in: query
          description: 'When true, a role is not overwritten if it already exists.'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_put_payload'
            examples:
              createOrUpdateRoleRequest:
                value:
                  description: My custom Kibana role.
                  elasticsearch:
                    cluster:
                      - monitor
                    indices:
                      - names:
                          - logs-*
                        privileges:
                          - read
                  kibana:
                    - base:
                        - read
                      feature: { }
                      spaces:
                        - default
              createRoleRequest1:
                $ref: '#/components/examples/create_role_request1'
              createRoleRequest2:
                $ref: '#/components/examples/create_role_request2'
              createRoleRequest3:
                $ref: '#/components/examples/create_role_request3'
              createRoleRequest4:
                $ref: '#/components/examples/create_role_request4'
      responses:
        '204':
          description: Indicates a successful call.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/roles:
    post:
      tags:
        - roles
      summary: Create or update roles
      description: Create or update multiple Kibana roles in a single request.
      operationId: post-security-roles
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_security_roles_bulk_create_or_update_payload'
            examples:
              bulkCreateOrUpdateRoles:
                value:
                  roles:
                    my_kibana_role:
                      elasticsearch:
                        cluster:
                          - monitor
                        indices:
                          - names:
                              - logs-*
                            privileges:
                              - read
                      kibana:
                        - base:
                            - read
                          feature: { }
                          spaces:
                            - default
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_security_bulk_create_or_update_roles_response'
              examples:
                bulkCreateOrUpdateRolesResponse:
                  value:
                    created:
                      - my_kibana_role
                    noop: [ ]
                    updated: [ ]
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/security/session/_invalidate:
    post:
      tags:
        - user session
      summary: Invalidate user sessions
      description: "Invalidate user sessions that match a query. To use this API, you must be a superuser.\n"
      operationId: post-security-session-invalidate
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - match
              type: object
              properties:
                match:
                  enum:
                    - all
                    - query
                  type: string
                  description: "The method Kibana uses to determine which sessions to invalidate. If it is `all`, all existing sessions will be invalidated. If it is `query`, only the sessions that match the query will be invalidated.\n"
                query:
                  required:
                    - provider
                  type: object
                  properties:
                    provider:
                      required:
                        - type
                      type: object
                      properties:
                        name:
                          type: string
                          description: The authentication provider name.
                        type:
                          type: string
                          description: "The authentication provide type. For example: `basic`, `token`, `saml`, `oidc`, `kerberos`, or `pki`.\n"
                      description: The authentication providers that will have their user sessions invalidated.
                    username:
                      type: string
                      description: The username that will have its sessions invalidated.
                  description: "The query that Kibana uses to match the sessions to invalidate when the `match` parameter is set to `query`.\n"
            examples:
              invalidateRequestExample1:
                summary: Invalidate all sessions
                description: Run `POST api/security/session/_invalidate` to invalidate all existing sessions.
                value: "{\n  \"match\" : \"all\"\n}"
              invalidateRequestExample2:
                summary: Invalidate all SAML sessions
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any SAML authentication provider.
                value: "{\n  \"match\" : \"query\",\n  \"query\": {\n    \"provider\" : { \"type\": \"saml\" }\n  }\n}"
              invalidateRequestExample3:
                summary: Invalidate sessions for a provider
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by the SAML authentication provider named `saml1`.
                value: "{\n  \"match\" : \"query\",\n  \"query\": {\n    \"provider\" : { \"type\": \"saml\", \"name\": \"saml1\" }\n  }\n}"
              invalidateRequestExample4:
                summary: Invalidate sessions for a user
                description: Run `POST api/security/session/_invalidate` to invalidate sessions that were created by any OpenID Connect authentication provider for the user with the username `user@my-oidc-sso.com`.
                value: "{\n  \"match\" : \"query\",\n  \"query\": {\n    \"provider\" : { \"type\": \"oidc\" },\n    \"username\": \"user@my-oidc-sso.com\"\n  }\n}"
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                type: object
                properties:
                  total:
                    type: integer
                    description: The number of sessions that were successfully invalidated.
        '403':
          description: Indicates that the user may not be authorized to invalidate sessions for other users.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/short_url:
    post:
      tags:
        - short url
      summary: Create a short URL
      description: "Kibana URLs may be long and cumbersome, short URLs are much easier to remember and share.\nShort URLs are created by specifying the locator ID and locator parameters. When a short URL is resolved, the locator ID and locator parameters are used to redirect user to the right Kibana page.\n"
      operationId: post-url
      requestBody:
        content:
          application/json:
            schema:
              required:
                - locatorId
                - params
              type: object
              properties:
                humanReadableSlug:
                  type: boolean
                  description: "When the `slug` parameter is omitted, the API will generate a random human-readable slug if `humanReadableSlug` is set to true.\n"
                locatorId:
                  type: string
                  description: The identifier for the locator.
                params:
                  type: object
                  description: "An object which contains all necessary parameters for the given locator to resolve to a Kibana location.\n> warn\n> When you create a short URL, locator params are not validated, which allows you to pass arbitrary and ill-formed data into the API that can break Kibana. Make sure any data that you send to the API is properly formed.\n"
                slug:
                  type: string
                  description: "A custom short URL slug. The slug is the part of the short URL that identifies it. You can provide a custom slug which consists of latin alphabet letters, numbers, and `-._` characters. The slug must be at least 3 characters long, but no longer than 255 characters.\n"
            examples:
              createShortUrlRequest:
                summary: Create a short URL for a dashboard locator
                description: Request a short URL that resolves to a dashboard with a preset time range.
                value:
                  locatorId: DASHBOARD_APP_LOCATOR
                  params:
                    dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                    timeRange:
                      from: now-7d
                      to: now
                  slug: my-dashboard
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Short_URL_APIs_urlResponse'
              examples:
                createShortUrlResponse:
                  summary: Short URL created
                  description: The created short URL record.
                  value:
                    accessCount: 0
                    accessDate: 1767225600000
                    createDate: 1767225600000
                    id: c54b04f5d4b3aa3c
                    locator:
                      id: DASHBOARD_APP_LOCATOR
                      state:
                        dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                        timeRange:
                          from: now-7d
                          to: now
                      version: '9.4.0'
                    slug: my-dashboard
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/short_url/_slug/{slug}':
    get:
      tags:
        - short url
      summary: Resolve a short URL
      description: "Resolve a Kibana short URL by its slug.\n"
      operationId: resolve-url
      parameters:
        - name: slug
          in: path
          description: The slug of the short URL.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Short_URL_APIs_urlResponse'
              examples:
                resolveShortUrlResponse:
                  summary: Short URL resolved by slug
                  description: The short URL record matching the given slug.
                  value:
                    accessCount: 12
                    accessDate: 1767744000000
                    createDate: 1767225600000
                    id: c54b04f5d4b3aa3c
                    locator:
                      id: DASHBOARD_APP_LOCATOR
                      state:
                        dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                        timeRange:
                          from: now-7d
                          to: now
                      version: '9.4.0'
                    slug: my-dashboard
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/short_url/{id}':
    delete:
      tags:
        - short url
      summary: Delete a short URL
      description: "Delete a Kibana short URL.\n"
      operationId: delete-url
      parameters:
        - $ref: '#/components/parameters/Short_URL_APIs_idParam'
      responses:
        '200':
          description: Indicates a successful call.
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - short url
      summary: Get a short URL
      description: "Get a single Kibana short URL.\n"
      operationId: get-url
      parameters:
        - $ref: '#/components/parameters/Short_URL_APIs_idParam'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Short_URL_APIs_urlResponse'
              examples:
                getShortUrlResponse:
                  summary: Short URL retrieved by ID
                  description: The short URL record matching the given identifier.
                  value:
                    accessCount: 12
                    accessDate: 1767744000000
                    createDate: 1767225600000
                    id: c54b04f5d4b3aa3c
                    locator:
                      id: DASHBOARD_APP_LOCATOR
                      state:
                        dashboardId: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
                        timeRange:
                          from: now-7d
                          to: now
                      version: '9.4.0'
                    slug: my-dashboard
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_copy_saved_objects:
    post:
      tags:
        - spaces
      summary: Copy saved objects between spaces
      description: 'It also allows you to automatically copy related objects, so when you copy a dashboard, this can automatically copy over the associated visualizations, data views, and saved Discover sessions, as required. You can request to overwrite any objects that already exist in the target space if they share an identifier or you can use the resolve copy saved objects conflicts API to do this on a per-object basis.<br/><br/>[Required authorization] Route required privileges: copySavedObjectsToSpaces.'
      operationId: post-spaces-copy-saved-objects
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - spaces
                - objects
              type: object
              properties:
                compatibilityMode:
                  type: boolean
                  description: Apply various adjustments to the saved objects that are being copied to maintain compatibility between different Kibana versions. Use this option only if you encounter issues with copied saved objects. This option cannot be used with the `createNewCopies` option.
                  default: false
                createNewCopies:
                  type: boolean
                  description: 'Create new copies of saved objects, regenerate each object identifier, and reset the origin. When used, potential conflict errors are avoided.  This option cannot be used with the `overwrite` and `compatibilityMode` options.'
                  default: true
                includeReferences:
                  type: boolean
                  description: 'When set to true, all saved objects related to the specified saved objects will also be copied into the target spaces.'
                  default: false
                objects:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        type: string
                        description: The identifier of the saved object to copy.
                      type:
                        type: string
                        description: The type of the saved object to copy.
                    additionalProperties: false
                overwrite:
                  type: boolean
                  description: 'When set to true, all conflicts are automatically overridden. When a saved object with a matching type and identifier exists in the target space, that version is replaced with the version from the source space. This option cannot be used with the `createNewCopies` option.'
                  default: false
                spaces:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                    description: The identifiers of the spaces where you want to copy the specified objects.
              additionalProperties: false
            examples:
              copySavedObjectsRequestExample1:
                $ref: '#/components/examples/copy_saved_objects_request1'
              copySavedObjectsRequestExample2:
                $ref: '#/components/examples/copy_saved_objects_request2'
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              examples:
                copySavedObjectsResponseExample1:
                  $ref: '#/components/examples/copy_saved_objects_response1'
                copySavedObjectsResponseExample2:
                  $ref: '#/components/examples/copy_saved_objects_response2'
                copySavedObjectsResponseExample3:
                  $ref: '#/components/examples/copy_saved_objects_response3'
                copySavedObjectsResponseExample4:
                  $ref: '#/components/examples/copy_saved_objects_response4'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_disable_legacy_url_aliases:
    post:
      tags:
        - spaces
      summary: Disable legacy URL aliases
      description: Disable one or more legacy URL aliases so that they no longer resolve to their target saved objects.
      operationId: post-spaces-disable-legacy-url-aliases
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - aliases
              type: object
              properties:
                aliases:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - targetSpace
                      - targetType
                      - sourceId
                    type: object
                    properties:
                      sourceId:
                        type: string
                        description: The alias source object identifier. This is the legacy object identifier.
                      targetSpace:
                        type: string
                        description: The space where the alias target object exists.
                      targetType:
                        type: string
                        description: 'The type of alias target object. '
                    additionalProperties: false
              additionalProperties: false
            examples:
              disableLegacyURLRequestExample1:
                $ref: '#/components/examples/disable_legacy_url_request1'
      responses:
        '204':
          description: Indicates a successful call.
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_get_shareable_references:
    post:
      tags:
        - spaces
      summary: Get shareable references
      description: Collect references and space contexts for saved objects.
      operationId: post-spaces-get-shareable-references
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - objects
              type: object
              properties:
                objects:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        type: string
                      type:
                        type: string
                    additionalProperties: false
              additionalProperties: false
            examples:
              getShareableReferencesRequestExample1:
                $ref: '#/components/examples/get_shareable_references_request1'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              examples:
                getShareableReferencesResponseExample1:
                  $ref: '#/components/examples/get_shareable_references_response1'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_resolve_copy_saved_objects_errors:
    post:
      summary: Resolve conflicts copying saved objects
      description: 'Overwrite saved objects that are returned as errors from the copy saved objects to space API.<br/><br/>[Required authorization] Route required privileges: copySavedObjectsToSpaces.'
      operationId: post-spaces-resolve-copy-saved-objects-errors
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - retries
                - objects
              type: object
              properties:
                compatibilityMode:
                  type: boolean
                  default: false
                createNewCopies:
                  type: boolean
                  default: true
                includeReferences:
                  type: boolean
                  default: false
                objects:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        type: string
                      type:
                        type: string
                    additionalProperties: false
                retries:
                  type: object
                  additionalProperties:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - type
                        - id
                      type: object
                      properties:
                        createNewCopy:
                          type: boolean
                          description: 'Creates new copies of the saved objects, regenerates each object ID, and resets the origin.'
                        destinationId:
                          type: string
                          description: 'Specifies the destination identifier that the copied object should have, if different from the current identifier.'
                        id:
                          type: string
                          description: The saved object identifier.
                        ignoreMissingReferences:
                          type: boolean
                          description: 'When set to true, any missing references errors are ignored.'
                        overwrite:
                          type: boolean
                          description: 'When set to true, the saved object from the source space overwrites the conflicting object in the destination space.'
                          default: false
                        type:
                          type: string
                          description: The saved object type.
                      additionalProperties: false
              additionalProperties: false
            examples:
              resolveCopySavedObjectsRequestExample1:
                $ref: '#/components/examples/resolve_copy_saved_objects_request1'
              resolveCopySavedObjectsRequestExample2:
                $ref: '#/components/examples/resolve_copy_saved_objects_request2'
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              examples:
                resolveCopySavedObjectsResponseExample1:
                  $ref: '#/components/examples/copy_saved_objects_response1'
                resolveCopySavedObjectsResponseExample2:
                  $ref: '#/components/examples/copy_saved_objects_response2'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/_update_objects_spaces:
    post:
      tags:
        - spaces
      summary: Update saved objects in spaces
      description: Update one or more saved objects to add or remove them from some spaces.
      operationId: post-spaces-update-objects-spaces
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - objects
                - spacesToAdd
                - spacesToRemove
              type: object
              properties:
                objects:
                  maxItems: 1000
                  type: array
                  items:
                    required:
                      - type
                      - id
                    type: object
                    properties:
                      id:
                        type: string
                        description: The identifier of the saved object to update.
                      type:
                        type: string
                        description: The type of the saved object to update.
                    additionalProperties: false
                spacesToAdd:
                  maxItems: 1000
                  type: array
                  items:
                    type: string
                    description: The identifiers of the spaces the saved objects should be added to or removed from.
                spacesToRemove:
                  maxItems: 1000
                  type: array
                  items:
                    type: string
                    description: The identifiers of the spaces the saved objects should be added to or removed from.
              additionalProperties: false
            examples:
              updateObjectSpacesRequestExample1:
                $ref: '#/components/examples/update_saved_objects_spaces_request1'
      responses:
        '200':
          description: 'OK: A successful request.'
          content:
            application/json:
              examples:
                updateObjectSpacesResponseExample1:
                  $ref: '#/components/examples/update_saved_objects_spaces_response1'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/spaces/space:
    get:
      tags:
        - spaces
      summary: Get all spaces
      description: Retrieve all available Kibana spaces. The list includes only the spaces that the user is authorized to access.
      operationId: get-spaces-space
      parameters:
        - name: purpose
          in: query
          description: Specifies which authorization checks are applied to the API call. The default value is `any`.
          schema:
            enum:
              - any
              - copySavedObjectsIntoSpace
              - shareSavedObjectsIntoSpace
            type: string
        - name: include_authorized_purposes
          in: query
          description: 'When enabled, the API returns any spaces the user is authorized to access in any capacity, each including the purposes for which the user is authorized. This is useful for identifying spaces the user can read but is not authorized for a given purpose. Without the security plugin, this parameter has no effect, because no authorization checks are performed. This parameter cannot be used together with the `purpose` parameter.'
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              examples:
                getSpacesResponseExample1:
                  $ref: '#/components/examples/get_spaces_response1'
                getSpacesResponseExample2:
                  $ref: '#/components/examples/get_spaces_response2'
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - spaces
      summary: Create a space
      description: Create a new Kibana space.
      operationId: post-spaces-space
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - id
                - name
              type: object
              properties:
                _reserved:
                  type: boolean
                color:
                  type: string
                  description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
                description:
                  type: string
                  description: A description for the space.
                disabledFeatures:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                    description: The list of features that are turned off in the space.
                  default: [ ]
                id:
                  type: string
                  description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
                imageUrl:
                  type: string
                  description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
                initials:
                  maxLength: 2
                  type: string
                  description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
                name:
                  minLength: 1
                  type: string
                  description: 'The display name for the space. '
                projectRouting:
                  type: string
                  description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                solution:
                  enum:
                    - security
                    - oblt
                    - es
                    - classic
                  type: string
              additionalProperties: false
            examples:
              createSpaceRequest:
                $ref: '#/components/examples/create_space_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - id
                  - name
                type: object
                properties:
                  _reserved:
                    type: boolean
                  color:
                    type: string
                    description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
                  description:
                    type: string
                    description: A description for the space.
                  disabledFeatures:
                    maxItems: 100
                    type: array
                    items:
                      type: string
                      description: The list of features that are turned off in the space.
                    default: [ ]
                  id:
                    type: string
                    description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
                  imageUrl:
                    type: string
                    description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
                  initials:
                    maxLength: 2
                    type: string
                    description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
                  name:
                    minLength: 1
                    type: string
                    description: 'The display name for the space. '
                  projectRouting:
                    type: string
                    description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                  solution:
                    enum:
                      - security
                      - oblt
                      - es
                      - classic
                    type: string
                additionalProperties: false
              examples:
                createSpaceResponseExample:
                  $ref: '#/components/examples/get_space_response'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/spaces/space/{id}':
    delete:
      tags:
        - spaces
      summary: Delete a space
      description: 'When you delete a space, all saved objects that belong to the space are automatically deleted, which is permanent and cannot be undone.'
      operationId: delete-spaces-space-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The space identifier.
          required: true
          schema:
            type: string
      responses:
        '204':
          description: Indicates a successful call.
        '404':
          description: Indicates that the request failed.
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - spaces
      summary: Get a space
      description: Retrieve a single Kibana space by its identifier.
      operationId: get-spaces-space-id
      parameters:
        - name: id
          in: path
          description: The space identifier.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - id
                  - name
                type: object
                properties:
                  _reserved:
                    type: boolean
                  color:
                    type: string
                    description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
                  description:
                    type: string
                    description: A description for the space.
                  disabledFeatures:
                    maxItems: 100
                    type: array
                    items:
                      type: string
                      description: The list of features that are turned off in the space.
                    default: [ ]
                  id:
                    type: string
                    description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
                  imageUrl:
                    type: string
                    description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
                  initials:
                    maxLength: 2
                    type: string
                    description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
                  name:
                    minLength: 1
                    type: string
                    description: 'The display name for the space. '
                  projectRouting:
                    type: string
                    description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                  solution:
                    enum:
                      - security
                      - oblt
                      - es
                      - classic
                    type: string
                additionalProperties: false
              examples:
                getSpaceResponse:
                  summary: Get details about a marketing space
                  description: A response that contains the full configuration for a single Kibana space.
                  value:
                    color: '#aabbcc'
                    description: This is the Marketing Space
                    disabledFeatures: [ ]
                    id: marketing
                    imageUrl: ''
                    initials: MK
                    name: Marketing
                    solution: es
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - spaces
      summary: Update a space
      description: Update an existing Kibana space.
      operationId: put-spaces-space-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: The space identifier. You are unable to change the ID with the update operation.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - id
                - name
              type: object
              properties:
                _reserved:
                  type: boolean
                color:
                  type: string
                  description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
                description:
                  type: string
                  description: A description for the space.
                disabledFeatures:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                    description: The list of features that are turned off in the space.
                  default: [ ]
                id:
                  type: string
                  description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
                imageUrl:
                  type: string
                  description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
                initials:
                  maxLength: 2
                  type: string
                  description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
                name:
                  minLength: 1
                  type: string
                  description: 'The display name for the space. '
                projectRouting:
                  type: string
                  description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                solution:
                  enum:
                    - security
                    - oblt
                    - es
                    - classic
                  type: string
              additionalProperties: false
            examples:
              updateSpaceRequest:
                $ref: '#/components/examples/update_space_request'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - id
                  - name
                type: object
                properties:
                  _reserved:
                    type: boolean
                  color:
                    type: string
                    description: 'The hexadecimal color code used in the space avatar. By default, the color is automatically generated from the space name.'
                  description:
                    type: string
                    description: A description for the space.
                  disabledFeatures:
                    maxItems: 100
                    type: array
                    items:
                      type: string
                      description: The list of features that are turned off in the space.
                    default: [ ]
                  id:
                    type: string
                    description: 'The space ID that is part of the Kibana URL when inside the space. Space IDs are limited to lowercase alphanumeric, underscore, and hyphen characters (a-z, 0-9, _, and -). You are cannot change the ID with the update operation.'
                  imageUrl:
                    type: string
                    description: 'The data-URL encoded image to display in the space avatar. If specified, initials will not be displayed and the color will be visible as the background color for transparent images. For best results, your image should be 64x64. Images will not be optimized by this API call, so care should be taken when using custom images.'
                  initials:
                    maxLength: 2
                    type: string
                    description: 'One or two characters that are shown in the space avatar. By default, the initials are automatically generated from the space name.'
                  name:
                    minLength: 1
                    type: string
                    description: 'The display name for the space. '
                  projectRouting:
                    type: string
                    description: Cross-project search default routing configuration for this space. Controls whether searches are scoped to a single project or span multiple projects in serverless environments.
                  solution:
                    enum:
                      - security
                      - oblt
                      - es
                      - classic
                    type: string
                additionalProperties: false
              examples:
                updateSpaceResponse:
                  summary: Update the marketing space
                  description: A response that contains the updated configuration of the Kibana space.
                  value:
                    color: '#aabbcc'
                    description: An updated description for the Marketing Space
                    disabledFeatures: [ ]
                    id: marketing
                    imageUrl: ''
                    initials: MK
                    name: Marketing
                    solution: es
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/status:
    get:
      tags:
        - system
      summary: Get Kibana's current status
      description: 'Returns Kibana''s overall operational status and a per-service breakdown for Elasticsearch, Saved Objects, and registered plugins. The endpoint is intended for liveness and readiness checks (for example, by Kubernetes probes) and for operators monitoring a Kibana deployment. Unauthenticated callers receive a redacted response that exposes only the overall status level.'
      operationId: get-status
      parameters:
        - name: v7format
          in: query
          description: Set to "true" to get the response in v7 format.
          schema:
            type: boolean
        - name: v8format
          in: query
          description: Set to "true" to get the response in v8 format.
          schema:
            type: boolean
      responses:
        '200':
          description: Overall status is OK and Kibana should be functioning normally.
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse'
                description: Kibana's operational status. A minimal response is sent for unauthorized users.
              examples:
                statusAvailableResponse:
                  summary: Kibana is available
                  description: A successful response when Kibana and its core services are operating normally.
                  value:
                    metrics:
                      collection_interval_in_millis: 5000
                      elasticsearch_client:
                        totalActiveSockets: 4
                        totalIdleSockets: 2
                        totalQueuedRequests: 0
                      last_updated: '2026-04-30T12:00:05.000Z'
                    name: kibana
                    status:
                      core:
                        elasticsearch:
                          level: available
                          summary: Elasticsearch is available
                        savedObjects:
                          level: available
                          summary: SavedObjects service has completed migrations and is available
                      overall:
                        level: available
                        summary: All services are available
                      plugins: { }
                    uuid: 5b2de169-2785-441b-ae8c-186a1936b17d
                    version:
                      build_date: '2026-04-30T12:00:00.000Z'
                      build_flavor: traditional
                      build_hash: ad8f0fa4d5022f56bbe2c4d51e9d0fcfa1ee67fc
                      build_number: 100200
                      build_snapshot: false
                      number: '9.3.0'
                statusRedactedResponse:
                  summary: Kibana is available (redacted)
                  description: A redacted response returned when the caller is unauthenticated or lacks the `monitor` cluster privilege.
                  value:
                    status:
                      overall:
                        level: available
        '503':
          description: Kibana or some of its essential services are unavailable. Kibana may be degraded or unavailable.
          content:
            application/json:
              schema:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_response'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_core_status_redactedResponse'
                description: Kibana's operational status. A minimal response is sent for unauthorized users.
              examples:
                statusUnavailableResponse:
                  summary: Kibana is unavailable
                  description: A response when one or more core services are unavailable.
                  value:
                    metrics:
                      collection_interval_in_millis: 5000
                      elasticsearch_client:
                        totalActiveSockets: 0
                        totalIdleSockets: 0
                        totalQueuedRequests: 0
                      last_updated: '2026-04-30T12:00:05.000Z'
                    name: kibana
                    status:
                      core:
                        elasticsearch:
                          level: unavailable
                          summary: Unable to connect to Elasticsearch
                        savedObjects:
                          level: unavailable
                          summary: SavedObjects service depends on Elasticsearch
                      overall:
                        level: unavailable
                        summary: Some services are unavailable
                      plugins: { }
                    uuid: 5b2de169-2785-441b-ae8c-186a1936b17d
                    version:
                      build_date: '2026-04-30T12:00:00.000Z'
                      build_flavor: traditional
                      build_hash: ad8f0fa4d5022f56bbe2c4d51e9d0fcfa1ee67fc
                      build_number: 100200
                      build_snapshot: false
                      number: '9.3.0'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams:
    get:
      tags:
        - streams
      summary: Get stream list
      description: 'Fetches list of all streams<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: A list of all streams.
          content:
            application/json:
              examples:
                listStreams:
                  value:
                    streams:
                      - description: Root logs stream
                        ingest:
                          failure_store:
                            inherit: { }
                          lifecycle:
                            inherit: { }
                          processing:
                            steps: [ ]
                            updated_at: '2025-01-10T08:00:00.000Z'
                          settings: { }
                          wired:
                            fields:
                              '@timestamp':
                                type: date
                              log.level:
                                type: keyword
                              message:
                                type: match_only_text
                            routing:
                              - destination: logs.nginx
                                status: enabled
                                where:
                                  eq: nginx
                                  field: host.name
                        name: logs
                        type: wired
                        updated_at: '2025-01-10T08:00:00.000Z'
                      - description: 'Web server access logs, routed by severity'
                        ingest:
                          failure_store:
                            inherit: { }
                          lifecycle:
                            inherit: { }
                          processing:
                            steps: [ ]
                            updated_at: '2025-01-15T10:30:00.000Z'
                          settings: { }
                          wired:
                            fields:
                              host.name:
                                type: keyword
                              http.response.status_code:
                                type: long
                              message:
                                type: match_only_text
                            routing:
                              - destination: logs.nginx.errors
                                status: enabled
                                where:
                                  field: http.response.status_code
                                  gte: 500
                        name: logs.nginx
                        type: wired
                        updated_at: '2025-01-15T10:30:00.000Z'
                      - description: Legacy application logs
                        ingest:
                          classic: { }
                          failure_store:
                            disabled: { }
                          lifecycle:
                            dsl:
                              data_retention: 30d
                          processing:
                            steps:
                              - action: grok
                                from: message
                                ignore_missing: true
                                patterns:
                                  - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                            updated_at: '2024-12-01T09:00:00.000Z'
                          settings: { }
                        name: logs-myapp-default
                        type: classic
                        updated_at: '2024-12-01T09:00:00.000Z'
                      - description: All error-level logs across every stream
                        name: logs.errors
                        query:
                          esql: FROM logs* | WHERE log.level == "error"
                          view: logs.errors-view
                        type: query
                        updated_at: '2025-01-20T14:00:00.000Z'
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/_disable:
    post:
      tags:
        - streams
      summary: Disable streams
      description: 'Disables wired streams and deletes all existing stream definitions. The data of wired streams is deleted, but the data of classic streams is preserved.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-disable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: Streams were disabled successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/_enable:
    post:
      tags:
        - streams
      summary: Enable streams
      description: 'Enables wired streams<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-enable
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: Streams were enabled successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/streams/_resync:
    post:
      tags:
        - streams
      summary: Resync streams
      description: 'Resyncs all streams, making sure that Elasticsearch assets are up to date<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-resync
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: Streams were resynced successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{name}':
    delete:
      tags:
        - streams
      summary: Delete a stream
      description: 'Deletes a stream definition and the underlying data stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-name
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: The stream was deleted successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - streams
      summary: Get a stream
      description: 'Fetches a stream definition and associated dashboards<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name
      parameters:
        - name: name
          in: path
          description: The name of the stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: Stream definition and associated metadata.
          content:
            application/json:
              examples:
                getWiredStream:
                  value:
                    dashboards: [ ]
                    data_stream_exists: true
                    effective_failure_store:
                      disabled: { }
                      from: logs
                    effective_lifecycle:
                      dsl:
                        data_retention: 7d
                      from: logs
                    effective_settings: { }
                    inherited_fields:
                      '@timestamp':
                        from: logs
                        type: date
                      log.level:
                        from: logs
                        type: keyword
                    privileges:
                      create_snapshot_repository: false
                      lifecycle: true
                      manage: true
                      manage_failure_store: true
                      monitor: true
                      read_failure_store: true
                      simulate: true
                      text_structure: true
                      view_index_metadata: true
                    rules: [ ]
                    stream:
                      description: 'Web server access logs, routed by severity'
                      ingest:
                        failure_store:
                          inherit: { }
                        lifecycle:
                          inherit: { }
                        processing:
                          steps: [ ]
                          updated_at: '2025-01-15T10:30:00.000Z'
                        settings: { }
                        wired:
                          fields:
                            host.name:
                              type: keyword
                            http.response.status_code:
                              type: long
                            message:
                              type: match_only_text
                          routing:
                            - destination: logs.nginx.errors
                              status: enabled
                              where:
                                field: http.response.status_code
                                gte: 500
                      name: logs.nginx
                      type: wired
                      updated_at: '2025-01-15T10:30:00.000Z'
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - streams
      summary: Create or update a stream
      description: 'Creates or updates a stream definition. Classic streams can not be created through this API, only updated<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamUpsertRequest'
            examples:
              createQueryStream:
                value:
                  dashboards: [ ]
                  rules: [ ]
                  stream:
                    description: All error-level logs across every stream
                    query:
                      esql: FROM logs* | WHERE log.level == "error"
                      view: logs.errors-view
                    type: query
              createWiredStream:
                value:
                  dashboards: [ ]
                  rules: [ ]
                  stream:
                    description: 'Web server access logs, routed by severity'
                    ingest:
                      failure_store:
                        inherit: { }
                      lifecycle:
                        inherit: { }
                      processing:
                        steps: [ ]
                      settings: { }
                      wired:
                        fields:
                          host.name:
                            type: keyword
                          http.response.status_code:
                            type: long
                          message:
                            type: match_only_text
                        routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
                    type: wired
              updateClassicStream:
                value:
                  dashboards: [ ]
                  rules: [ ]
                  stream:
                    description: Legacy application logs managed as a classic data stream
                    ingest:
                      classic: { }
                      failure_store:
                        disabled: { }
                      lifecycle:
                        dsl:
                          data_retention: 30d
                      processing:
                        steps:
                          - action: grok
                            from: message
                            ignore_missing: true
                            patterns:
                              - '%{TIMESTAMP_ISO8601:timestamp} %{LOGLEVEL:log.level} %{GREEDYDATA:message}'
                      settings: { }
                    type: classic
      responses:
        '200':
          description: The stream was created or updated successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{name}/_fork':
    post:
      tags:
        - streams
      summary: Fork a stream
      description: 'Forks a wired stream and creates a child stream<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-fork
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the parent stream to fork from.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - stream
                - where
              type: object
              properties:
                draft:
                  type: boolean
                status:
                  enum:
                    - enabled
                    - disabled
                  type: string
                stream:
                  required:
                    - name
                  type: object
                  properties:
                    name:
                      maxLength: 200
                      type: string
                  additionalProperties: false
                where:
                  anyOf:
                    - anyOf:
                        - required:
                            - field
                          type: object
                          properties:
                            contains:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            endsWith:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            eq:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            field:
                              maxLength: 256
                              minLength: 1
                              type: string
                            gt:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            gte:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            includes:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            lt:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            lte:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            neq:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                            range:
                              type: object
                              properties:
                                gt:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                                gte:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                                lt:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                                lte:
                                  anyOf:
                                    - maxLength: 65535
                                      type: string
                                    - type: number
                                    - type: boolean
                              additionalProperties: false
                            startsWith:
                              anyOf:
                                - maxLength: 65535
                                  type: string
                                - type: number
                                - type: boolean
                          additionalProperties: false
                        - required:
                            - field
                          type: object
                          properties:
                            exists:
                              type: boolean
                            field:
                              maxLength: 256
                              minLength: 1
                              type: string
                          additionalProperties: false
                    - required:
                        - and
                      type: object
                      properties:
                        and:
                          maxItems: 50
                          type: array
                          items:
                            anyOf:
                              - anyOf:
                                  - required:
                                      - field
                                    type: object
                                    properties:
                                      contains:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      endsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      eq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                      gt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      gte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      includes:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      neq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      range:
                                        type: object
                                        properties:
                                          gt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          gte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                        additionalProperties: false
                                      startsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                    additionalProperties: false
                                  - required:
                                      - field
                                    type: object
                                    properties:
                                      exists:
                                        type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                    additionalProperties: false
                              - required:
                                  - and
                                type: object
                                properties:
                                  and:
                                    maxItems: 50
                                    type: array
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                  additionalProperties: false
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              additionalProperties: false
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              additionalProperties: false
                                        - required:
                                            - and
                                          type: object
                                          properties:
                                            and:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - or
                                          type: object
                                          properties:
                                            or:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - not
                                          type: object
                                          properties:
                                            not:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - always
                                          type: object
                                          properties:
                                            always:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - never
                                          type: object
                                          properties:
                                            never:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - or
                                type: object
                                properties:
                                  or:
                                    maxItems: 50
                                    type: array
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                  additionalProperties: false
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              additionalProperties: false
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              additionalProperties: false
                                        - required:
                                            - and
                                          type: object
                                          properties:
                                            and:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - or
                                          type: object
                                          properties:
                                            or:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - not
                                          type: object
                                          properties:
                                            not:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - always
                                          type: object
                                          properties:
                                            always:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - never
                                          type: object
                                          properties:
                                            never:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - not
                                type: object
                                properties:
                                  not:
                                    anyOf:
                                      - anyOf:
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              contains:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              endsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              eq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                              gt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              gte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              includes:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              neq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              range:
                                                type: object
                                                properties:
                                                  gt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  gte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                additionalProperties: false
                                              startsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                            additionalProperties: false
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              exists:
                                                type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                            additionalProperties: false
                                      - required:
                                          - and
                                        type: object
                                        properties:
                                          and:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - or
                                        type: object
                                        properties:
                                          or:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - not
                                        type: object
                                        properties:
                                          not:
                                            anyOf:
                                              - anyOf:
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    additionalProperties: false
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    additionalProperties: false
                                              - required:
                                                  - and
                                                type: object
                                                properties:
                                                  and:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - or
                                                type: object
                                                properties:
                                                  or:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - not
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - always
                                                type: object
                                                properties:
                                                  always:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - never
                                                type: object
                                                properties:
                                                  never:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - always
                                        type: object
                                        properties:
                                          always:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - never
                                        type: object
                                        properties:
                                          never:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - always
                                type: object
                                properties:
                                  always:
                                    type: object
                                    additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - never
                                type: object
                                properties:
                                  never:
                                    type: object
                                    additionalProperties: false
                                additionalProperties: false
                      additionalProperties: false
                    - required:
                        - or
                      type: object
                      properties:
                        or:
                          maxItems: 50
                          type: array
                          items:
                            anyOf:
                              - anyOf:
                                  - required:
                                      - field
                                    type: object
                                    properties:
                                      contains:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      endsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      eq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                      gt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      gte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      includes:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lt:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      lte:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      neq:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                      range:
                                        type: object
                                        properties:
                                          gt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          gte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lt:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                          lte:
                                            anyOf:
                                              - maxLength: 65535
                                                type: string
                                              - type: number
                                              - type: boolean
                                        additionalProperties: false
                                      startsWith:
                                        anyOf:
                                          - maxLength: 65535
                                            type: string
                                          - type: number
                                          - type: boolean
                                    additionalProperties: false
                                  - required:
                                      - field
                                    type: object
                                    properties:
                                      exists:
                                        type: boolean
                                      field:
                                        maxLength: 256
                                        minLength: 1
                                        type: string
                                    additionalProperties: false
                              - required:
                                  - and
                                type: object
                                properties:
                                  and:
                                    maxItems: 50
                                    type: array
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                  additionalProperties: false
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              additionalProperties: false
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              additionalProperties: false
                                        - required:
                                            - and
                                          type: object
                                          properties:
                                            and:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - or
                                          type: object
                                          properties:
                                            or:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - not
                                          type: object
                                          properties:
                                            not:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - always
                                          type: object
                                          properties:
                                            always:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - never
                                          type: object
                                          properties:
                                            never:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - or
                                type: object
                                properties:
                                  or:
                                    maxItems: 50
                                    type: array
                                    items:
                                      anyOf:
                                        - anyOf:
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                contains:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                endsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                eq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                includes:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                neq:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                range:
                                                  type: object
                                                  properties:
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                  additionalProperties: false
                                                startsWith:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              additionalProperties: false
                                            - required:
                                                - field
                                              type: object
                                              properties:
                                                exists:
                                                  type: boolean
                                                field:
                                                  maxLength: 256
                                                  minLength: 1
                                                  type: string
                                              additionalProperties: false
                                        - required:
                                            - and
                                          type: object
                                          properties:
                                            and:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - or
                                          type: object
                                          properties:
                                            or:
                                              maxItems: 50
                                              type: array
                                              items:
                                                anyOf:
                                                  - anyOf:
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          contains:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          endsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          eq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          includes:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          neq:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          range:
                                                            type: object
                                                            properties:
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          startsWith:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      - required:
                                                          - field
                                                        type: object
                                                        properties:
                                                          exists:
                                                            type: boolean
                                                          field:
                                                            maxLength: 256
                                                            minLength: 1
                                                            type: string
                                                        additionalProperties: false
                                                  - required:
                                                      - and
                                                    type: object
                                                    properties:
                                                      and:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - or
                                                    type: object
                                                    properties:
                                                      or:
                                                        maxItems: 50
                                                        type: array
                                                        items:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - and
                                                              type: object
                                                              properties:
                                                                and:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - or
                                                              type: object
                                                              properties:
                                                                or:
                                                                  maxItems: 50
                                                                  type: array
                                                                  items:
                                                                    anyOf:
                                                                      - anyOf:
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              contains:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              endsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              eq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              includes:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              neq:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              range:
                                                                                type: object
                                                                                properties:
                                                                                  gt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  gte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lt:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                  lte:
                                                                                    anyOf:
                                                                                      - maxLength: 65535
                                                                                        type: string
                                                                                      - type: number
                                                                                      - type: boolean
                                                                                additionalProperties: false
                                                                              startsWith:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          - required:
                                                                              - field
                                                                            type: object
                                                                            properties:
                                                                              exists:
                                                                                type: boolean
                                                                              field:
                                                                                maxLength: 256
                                                                                minLength: 1
                                                                                type: string
                                                                            additionalProperties: false
                                                                      - required:
                                                                          - always
                                                                        type: object
                                                                        properties:
                                                                          always:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - never
                                                                        type: object
                                                                        properties:
                                                                          never:
                                                                            type: object
                                                                            additionalProperties: false
                                                                        additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - not
                                                              type: object
                                                              properties:
                                                                not:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - not
                                                    type: object
                                                    properties:
                                                      not:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - always
                                                    type: object
                                                    properties:
                                                      always:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                                  - required:
                                                      - never
                                                    type: object
                                                    properties:
                                                      never:
                                                        type: object
                                                        additionalProperties: false
                                                    additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - not
                                          type: object
                                          properties:
                                            not:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - always
                                          type: object
                                          properties:
                                            always:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                        - required:
                                            - never
                                          type: object
                                          properties:
                                            never:
                                              type: object
                                              additionalProperties: false
                                          additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - not
                                type: object
                                properties:
                                  not:
                                    anyOf:
                                      - anyOf:
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              contains:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              endsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              eq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                              gt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              gte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              includes:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              neq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              range:
                                                type: object
                                                properties:
                                                  gt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  gte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                additionalProperties: false
                                              startsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                            additionalProperties: false
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              exists:
                                                type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                            additionalProperties: false
                                      - required:
                                          - and
                                        type: object
                                        properties:
                                          and:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - or
                                        type: object
                                        properties:
                                          or:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - not
                                        type: object
                                        properties:
                                          not:
                                            anyOf:
                                              - anyOf:
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    additionalProperties: false
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    additionalProperties: false
                                              - required:
                                                  - and
                                                type: object
                                                properties:
                                                  and:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - or
                                                type: object
                                                properties:
                                                  or:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - not
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - always
                                                type: object
                                                properties:
                                                  always:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - never
                                                type: object
                                                properties:
                                                  never:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - always
                                        type: object
                                        properties:
                                          always:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - never
                                        type: object
                                        properties:
                                          never:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - always
                                type: object
                                properties:
                                  always:
                                    type: object
                                    additionalProperties: false
                                additionalProperties: false
                              - required:
                                  - never
                                type: object
                                properties:
                                  never:
                                    type: object
                                    additionalProperties: false
                                additionalProperties: false
                      additionalProperties: false
                    - required:
                        - not
                      type: object
                      properties:
                        not:
                          anyOf:
                            - anyOf:
                                - required:
                                    - field
                                  type: object
                                  properties:
                                    contains:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    endsWith:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    eq:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    field:
                                      maxLength: 256
                                      minLength: 1
                                      type: string
                                    gt:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    gte:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    includes:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    lt:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    lte:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    neq:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                    range:
                                      type: object
                                      properties:
                                        gt:
                                          anyOf:
                                            - maxLength: 65535
                                              type: string
                                            - type: number
                                            - type: boolean
                                        gte:
                                          anyOf:
                                            - maxLength: 65535
                                              type: string
                                            - type: number
                                            - type: boolean
                                        lt:
                                          anyOf:
                                            - maxLength: 65535
                                              type: string
                                            - type: number
                                            - type: boolean
                                        lte:
                                          anyOf:
                                            - maxLength: 65535
                                              type: string
                                            - type: number
                                            - type: boolean
                                      additionalProperties: false
                                    startsWith:
                                      anyOf:
                                        - maxLength: 65535
                                          type: string
                                        - type: number
                                        - type: boolean
                                  additionalProperties: false
                                - required:
                                    - field
                                  type: object
                                  properties:
                                    exists:
                                      type: boolean
                                    field:
                                      maxLength: 256
                                      minLength: 1
                                      type: string
                                  additionalProperties: false
                            - required:
                                - and
                              type: object
                              properties:
                                and:
                                  maxItems: 50
                                  type: array
                                  items:
                                    anyOf:
                                      - anyOf:
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              contains:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              endsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              eq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                              gt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              gte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              includes:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              neq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              range:
                                                type: object
                                                properties:
                                                  gt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  gte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                additionalProperties: false
                                              startsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                            additionalProperties: false
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              exists:
                                                type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                            additionalProperties: false
                                      - required:
                                          - and
                                        type: object
                                        properties:
                                          and:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - or
                                        type: object
                                        properties:
                                          or:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - not
                                        type: object
                                        properties:
                                          not:
                                            anyOf:
                                              - anyOf:
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    additionalProperties: false
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    additionalProperties: false
                                              - required:
                                                  - and
                                                type: object
                                                properties:
                                                  and:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - or
                                                type: object
                                                properties:
                                                  or:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - not
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - always
                                                type: object
                                                properties:
                                                  always:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - never
                                                type: object
                                                properties:
                                                  never:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - always
                                        type: object
                                        properties:
                                          always:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - never
                                        type: object
                                        properties:
                                          never:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                              additionalProperties: false
                            - required:
                                - or
                              type: object
                              properties:
                                or:
                                  maxItems: 50
                                  type: array
                                  items:
                                    anyOf:
                                      - anyOf:
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              contains:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              endsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              eq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                              gt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              gte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              includes:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lt:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              lte:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              neq:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                              range:
                                                type: object
                                                properties:
                                                  gt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  gte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lt:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                  lte:
                                                    anyOf:
                                                      - maxLength: 65535
                                                        type: string
                                                      - type: number
                                                      - type: boolean
                                                additionalProperties: false
                                              startsWith:
                                                anyOf:
                                                  - maxLength: 65535
                                                    type: string
                                                  - type: number
                                                  - type: boolean
                                            additionalProperties: false
                                          - required:
                                              - field
                                            type: object
                                            properties:
                                              exists:
                                                type: boolean
                                              field:
                                                maxLength: 256
                                                minLength: 1
                                                type: string
                                            additionalProperties: false
                                      - required:
                                          - and
                                        type: object
                                        properties:
                                          and:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - or
                                        type: object
                                        properties:
                                          or:
                                            maxItems: 50
                                            type: array
                                            items:
                                              anyOf:
                                                - anyOf:
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        contains:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        endsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        eq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        includes:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        neq:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        range:
                                                          type: object
                                                          properties:
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        startsWith:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    - required:
                                                        - field
                                                      type: object
                                                      properties:
                                                        exists:
                                                          type: boolean
                                                        field:
                                                          maxLength: 256
                                                          minLength: 1
                                                          type: string
                                                      additionalProperties: false
                                                - required:
                                                    - and
                                                  type: object
                                                  properties:
                                                    and:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - or
                                                  type: object
                                                  properties:
                                                    or:
                                                      maxItems: 50
                                                      type: array
                                                      items:
                                                        anyOf:
                                                          - anyOf:
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  contains:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  endsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  eq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  includes:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  neq:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  range:
                                                                    type: object
                                                                    properties:
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  startsWith:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              - required:
                                                                  - field
                                                                type: object
                                                                properties:
                                                                  exists:
                                                                    type: boolean
                                                                  field:
                                                                    maxLength: 256
                                                                    minLength: 1
                                                                    type: string
                                                                additionalProperties: false
                                                          - required:
                                                              - and
                                                            type: object
                                                            properties:
                                                              and:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - or
                                                            type: object
                                                            properties:
                                                              or:
                                                                maxItems: 50
                                                                type: array
                                                                items:
                                                                  anyOf:
                                                                    - anyOf:
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            contains:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            endsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            eq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            includes:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            neq:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            range:
                                                                              type: object
                                                                              properties:
                                                                                gt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                gte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lt:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                                lte:
                                                                                  anyOf:
                                                                                    - maxLength: 65535
                                                                                      type: string
                                                                                    - type: number
                                                                                    - type: boolean
                                                                              additionalProperties: false
                                                                            startsWith:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        - required:
                                                                            - field
                                                                          type: object
                                                                          properties:
                                                                            exists:
                                                                              type: boolean
                                                                            field:
                                                                              maxLength: 256
                                                                              minLength: 1
                                                                              type: string
                                                                          additionalProperties: false
                                                                    - required:
                                                                        - always
                                                                      type: object
                                                                      properties:
                                                                        always:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - never
                                                                      type: object
                                                                      properties:
                                                                        never:
                                                                          type: object
                                                                          additionalProperties: false
                                                                      additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - not
                                                            type: object
                                                            properties:
                                                              not:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - always
                                                            type: object
                                                            properties:
                                                              always:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                          - required:
                                                              - never
                                                            type: object
                                                            properties:
                                                              never:
                                                                type: object
                                                                additionalProperties: false
                                                            additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - not
                                                  type: object
                                                  properties:
                                                    not:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - always
                                                  type: object
                                                  properties:
                                                    always:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                                - required:
                                                    - never
                                                  type: object
                                                  properties:
                                                    never:
                                                      type: object
                                                      additionalProperties: false
                                                  additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - not
                                        type: object
                                        properties:
                                          not:
                                            anyOf:
                                              - anyOf:
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    additionalProperties: false
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    additionalProperties: false
                                              - required:
                                                  - and
                                                type: object
                                                properties:
                                                  and:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - or
                                                type: object
                                                properties:
                                                  or:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - not
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - always
                                                type: object
                                                properties:
                                                  always:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - never
                                                type: object
                                                properties:
                                                  never:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - always
                                        type: object
                                        properties:
                                          always:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                                      - required:
                                          - never
                                        type: object
                                        properties:
                                          never:
                                            type: object
                                            additionalProperties: false
                                        additionalProperties: false
                              additionalProperties: false
                            - required:
                                - not
                              type: object
                              properties:
                                not:
                                  anyOf:
                                    - anyOf:
                                        - required:
                                            - field
                                          type: object
                                          properties:
                                            contains:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            endsWith:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            eq:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            field:
                                              maxLength: 256
                                              minLength: 1
                                              type: string
                                            gt:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            gte:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            includes:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            lt:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            lte:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            neq:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                            range:
                                              type: object
                                              properties:
                                                gt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                gte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lt:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                                lte:
                                                  anyOf:
                                                    - maxLength: 65535
                                                      type: string
                                                    - type: number
                                                    - type: boolean
                                              additionalProperties: false
                                            startsWith:
                                              anyOf:
                                                - maxLength: 65535
                                                  type: string
                                                - type: number
                                                - type: boolean
                                          additionalProperties: false
                                        - required:
                                            - field
                                          type: object
                                          properties:
                                            exists:
                                              type: boolean
                                            field:
                                              maxLength: 256
                                              minLength: 1
                                              type: string
                                          additionalProperties: false
                                    - required:
                                        - and
                                      type: object
                                      properties:
                                        and:
                                          maxItems: 50
                                          type: array
                                          items:
                                            anyOf:
                                              - anyOf:
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    additionalProperties: false
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    additionalProperties: false
                                              - required:
                                                  - and
                                                type: object
                                                properties:
                                                  and:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - or
                                                type: object
                                                properties:
                                                  or:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - not
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - always
                                                type: object
                                                properties:
                                                  always:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - never
                                                type: object
                                                properties:
                                                  never:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                      additionalProperties: false
                                    - required:
                                        - or
                                      type: object
                                      properties:
                                        or:
                                          maxItems: 50
                                          type: array
                                          items:
                                            anyOf:
                                              - anyOf:
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      contains:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      endsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      eq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                      gt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      gte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      includes:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lt:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      lte:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      neq:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                      range:
                                                        type: object
                                                        properties:
                                                          gt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          gte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lt:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                          lte:
                                                            anyOf:
                                                              - maxLength: 65535
                                                                type: string
                                                              - type: number
                                                              - type: boolean
                                                        additionalProperties: false
                                                      startsWith:
                                                        anyOf:
                                                          - maxLength: 65535
                                                            type: string
                                                          - type: number
                                                          - type: boolean
                                                    additionalProperties: false
                                                  - required:
                                                      - field
                                                    type: object
                                                    properties:
                                                      exists:
                                                        type: boolean
                                                      field:
                                                        maxLength: 256
                                                        minLength: 1
                                                        type: string
                                                    additionalProperties: false
                                              - required:
                                                  - and
                                                type: object
                                                properties:
                                                  and:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - or
                                                type: object
                                                properties:
                                                  or:
                                                    maxItems: 50
                                                    type: array
                                                    items:
                                                      anyOf:
                                                        - anyOf:
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                contains:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                endsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                eq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                includes:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                neq:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                range:
                                                                  type: object
                                                                  properties:
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                startsWith:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            - required:
                                                                - field
                                                              type: object
                                                              properties:
                                                                exists:
                                                                  type: boolean
                                                                field:
                                                                  maxLength: 256
                                                                  minLength: 1
                                                                  type: string
                                                              additionalProperties: false
                                                        - required:
                                                            - and
                                                          type: object
                                                          properties:
                                                            and:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - or
                                                          type: object
                                                          properties:
                                                            or:
                                                              maxItems: 50
                                                              type: array
                                                              items:
                                                                anyOf:
                                                                  - anyOf:
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          contains:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          endsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          eq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          includes:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          neq:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          range:
                                                                            type: object
                                                                            properties:
                                                                              gt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              gte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lt:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                              lte:
                                                                                anyOf:
                                                                                  - maxLength: 65535
                                                                                    type: string
                                                                                  - type: number
                                                                                  - type: boolean
                                                                            additionalProperties: false
                                                                          startsWith:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      - required:
                                                                          - field
                                                                        type: object
                                                                        properties:
                                                                          exists:
                                                                            type: boolean
                                                                          field:
                                                                            maxLength: 256
                                                                            minLength: 1
                                                                            type: string
                                                                        additionalProperties: false
                                                                  - required:
                                                                      - always
                                                                    type: object
                                                                    properties:
                                                                      always:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - never
                                                                    type: object
                                                                    properties:
                                                                      never:
                                                                        type: object
                                                                        additionalProperties: false
                                                                    additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - not
                                                          type: object
                                                          properties:
                                                            not:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - always
                                                          type: object
                                                          properties:
                                                            always:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                        - required:
                                                            - never
                                                          type: object
                                                          properties:
                                                            never:
                                                              type: object
                                                              additionalProperties: false
                                                          additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - not
                                                type: object
                                                properties:
                                                  not:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - always
                                                type: object
                                                properties:
                                                  always:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                              - required:
                                                  - never
                                                type: object
                                                properties:
                                                  never:
                                                    type: object
                                                    additionalProperties: false
                                                additionalProperties: false
                                      additionalProperties: false
                                    - required:
                                        - not
                                      type: object
                                      properties:
                                        not:
                                          anyOf:
                                            - anyOf:
                                                - required:
                                                    - field
                                                  type: object
                                                  properties:
                                                    contains:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    endsWith:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    eq:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    field:
                                                      maxLength: 256
                                                      minLength: 1
                                                      type: string
                                                    gt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    gte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    includes:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lt:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    lte:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    neq:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                    range:
                                                      type: object
                                                      properties:
                                                        gt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        gte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lt:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                        lte:
                                                          anyOf:
                                                            - maxLength: 65535
                                                              type: string
                                                            - type: number
                                                            - type: boolean
                                                      additionalProperties: false
                                                    startsWith:
                                                      anyOf:
                                                        - maxLength: 65535
                                                          type: string
                                                        - type: number
                                                        - type: boolean
                                                  additionalProperties: false
                                                - required:
                                                    - field
                                                  type: object
                                                  properties:
                                                    exists:
                                                      type: boolean
                                                    field:
                                                      maxLength: 256
                                                      minLength: 1
                                                      type: string
                                                  additionalProperties: false
                                            - required:
                                                - and
                                              type: object
                                              properties:
                                                and:
                                                  maxItems: 50
                                                  type: array
                                                  items:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                              additionalProperties: false
                                            - required:
                                                - or
                                              type: object
                                              properties:
                                                or:
                                                  maxItems: 50
                                                  type: array
                                                  items:
                                                    anyOf:
                                                      - anyOf:
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              contains:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              endsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              eq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                              gt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              gte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              includes:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lt:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              lte:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              neq:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                              range:
                                                                type: object
                                                                properties:
                                                                  gt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  gte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lt:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                  lte:
                                                                    anyOf:
                                                                      - maxLength: 65535
                                                                        type: string
                                                                      - type: number
                                                                      - type: boolean
                                                                additionalProperties: false
                                                              startsWith:
                                                                anyOf:
                                                                  - maxLength: 65535
                                                                    type: string
                                                                  - type: number
                                                                  - type: boolean
                                                            additionalProperties: false
                                                          - required:
                                                              - field
                                                            type: object
                                                            properties:
                                                              exists:
                                                                type: boolean
                                                              field:
                                                                maxLength: 256
                                                                minLength: 1
                                                                type: string
                                                            additionalProperties: false
                                                      - required:
                                                          - and
                                                        type: object
                                                        properties:
                                                          and:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - or
                                                        type: object
                                                        properties:
                                                          or:
                                                            maxItems: 50
                                                            type: array
                                                            items:
                                                              anyOf:
                                                                - anyOf:
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        contains:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        endsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        eq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        includes:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        neq:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        range:
                                                                          type: object
                                                                          properties:
                                                                            gt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            gte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lt:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                            lte:
                                                                              anyOf:
                                                                                - maxLength: 65535
                                                                                  type: string
                                                                                - type: number
                                                                                - type: boolean
                                                                          additionalProperties: false
                                                                        startsWith:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    - required:
                                                                        - field
                                                                      type: object
                                                                      properties:
                                                                        exists:
                                                                          type: boolean
                                                                        field:
                                                                          maxLength: 256
                                                                          minLength: 1
                                                                          type: string
                                                                      additionalProperties: false
                                                                - required:
                                                                    - always
                                                                  type: object
                                                                  properties:
                                                                    always:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                                - required:
                                                                    - never
                                                                  type: object
                                                                  properties:
                                                                    never:
                                                                      type: object
                                                                      additionalProperties: false
                                                                  additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - not
                                                        type: object
                                                        properties:
                                                          not:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - always
                                                        type: object
                                                        properties:
                                                          always:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                                      - required:
                                                          - never
                                                        type: object
                                                        properties:
                                                          never:
                                                            type: object
                                                            additionalProperties: false
                                                        additionalProperties: false
                                              additionalProperties: false
                                            - required:
                                                - not
                                              type: object
                                              properties:
                                                not:
                                                  anyOf:
                                                    - anyOf:
                                                        - required:
                                                            - field
                                                          type: object
                                                          properties:
                                                            contains:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            endsWith:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            eq:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            field:
                                                              maxLength: 256
                                                              minLength: 1
                                                              type: string
                                                            gt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            gte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            includes:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lt:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            lte:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            neq:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                            range:
                                                              type: object
                                                              properties:
                                                                gt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                gte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lt:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                                lte:
                                                                  anyOf:
                                                                    - maxLength: 65535
                                                                      type: string
                                                                    - type: number
                                                                    - type: boolean
                                                              additionalProperties: false
                                                            startsWith:
                                                              anyOf:
                                                                - maxLength: 65535
                                                                  type: string
                                                                - type: number
                                                                - type: boolean
                                                          additionalProperties: false
                                                        - required:
                                                            - field
                                                          type: object
                                                          properties:
                                                            exists:
                                                              type: boolean
                                                            field:
                                                              maxLength: 256
                                                              minLength: 1
                                                              type: string
                                                          additionalProperties: false
                                                    - required:
                                                        - and
                                                      type: object
                                                      properties:
                                                        and:
                                                          maxItems: 50
                                                          type: array
                                                          items:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                      additionalProperties: false
                                                    - required:
                                                        - or
                                                      type: object
                                                      properties:
                                                        or:
                                                          maxItems: 50
                                                          type: array
                                                          items:
                                                            anyOf:
                                                              - anyOf:
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      contains:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      endsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      eq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                      gt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      gte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      includes:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lt:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      lte:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      neq:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                      range:
                                                                        type: object
                                                                        properties:
                                                                          gt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          gte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lt:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                          lte:
                                                                            anyOf:
                                                                              - maxLength: 65535
                                                                                type: string
                                                                              - type: number
                                                                              - type: boolean
                                                                        additionalProperties: false
                                                                      startsWith:
                                                                        anyOf:
                                                                          - maxLength: 65535
                                                                            type: string
                                                                          - type: number
                                                                          - type: boolean
                                                                    additionalProperties: false
                                                                  - required:
                                                                      - field
                                                                    type: object
                                                                    properties:
                                                                      exists:
                                                                        type: boolean
                                                                      field:
                                                                        maxLength: 256
                                                                        minLength: 1
                                                                        type: string
                                                                    additionalProperties: false
                                                              - required:
                                                                  - always
                                                                type: object
                                                                properties:
                                                                  always:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                              - required:
                                                                  - never
                                                                type: object
                                                                properties:
                                                                  never:
                                                                    type: object
                                                                    additionalProperties: false
                                                                additionalProperties: false
                                                      additionalProperties: false
                                                    - required:
                                                        - not
                                                      type: object
                                                      properties:
                                                        not:
                                                          anyOf:
                                                            - anyOf:
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    contains:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    endsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    eq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                    gt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    gte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    includes:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lt:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    lte:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    neq:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                    range:
                                                                      type: object
                                                                      properties:
                                                                        gt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        gte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lt:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                        lte:
                                                                          anyOf:
                                                                            - maxLength: 65535
                                                                              type: string
                                                                            - type: number
                                                                            - type: boolean
                                                                      additionalProperties: false
                                                                    startsWith:
                                                                      anyOf:
                                                                        - maxLength: 65535
                                                                          type: string
                                                                        - type: number
                                                                        - type: boolean
                                                                  additionalProperties: false
                                                                - required:
                                                                    - field
                                                                  type: object
                                                                  properties:
                                                                    exists:
                                                                      type: boolean
                                                                    field:
                                                                      maxLength: 256
                                                                      minLength: 1
                                                                      type: string
                                                                  additionalProperties: false
                                                            - required:
                                                                - always
                                                              type: object
                                                              properties:
                                                                always:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                            - required:
                                                                - never
                                                              type: object
                                                              properties:
                                                                never:
                                                                  type: object
                                                                  additionalProperties: false
                                                              additionalProperties: false
                                                      additionalProperties: false
                                                    - required:
                                                        - always
                                                      type: object
                                                      properties:
                                                        always:
                                                          type: object
                                                          additionalProperties: false
                                                      additionalProperties: false
                                                    - required:
                                                        - never
                                                      type: object
                                                      properties:
                                                        never:
                                                          type: object
                                                          additionalProperties: false
                                                      additionalProperties: false
                                              additionalProperties: false
                                            - required:
                                                - always
                                              type: object
                                              properties:
                                                always:
                                                  type: object
                                                  additionalProperties: false
                                              additionalProperties: false
                                            - required:
                                                - never
                                              type: object
                                              properties:
                                                never:
                                                  type: object
                                                  additionalProperties: false
                                              additionalProperties: false
                                      additionalProperties: false
                                    - required:
                                        - always
                                      type: object
                                      properties:
                                        always:
                                          type: object
                                          additionalProperties: false
                                      additionalProperties: false
                                    - required:
                                        - never
                                      type: object
                                      properties:
                                        never:
                                          type: object
                                          additionalProperties: false
                                      additionalProperties: false
                              additionalProperties: false
                            - required:
                                - always
                              type: object
                              properties:
                                always:
                                  type: object
                                  additionalProperties: false
                              additionalProperties: false
                            - required:
                                - never
                              type: object
                              properties:
                                never:
                                  type: object
                                  additionalProperties: false
                              additionalProperties: false
                      additionalProperties: false
                    - required:
                        - always
                      type: object
                      properties:
                        always:
                          type: object
                          additionalProperties: false
                      additionalProperties: false
                    - required:
                        - never
                      type: object
                      properties:
                        never:
                          type: object
                          additionalProperties: false
                      additionalProperties: false
              additionalProperties: false
            examples:
              forkStream:
                value:
                  status: enabled
                  stream:
                    name: logs.nginx.errors
                  where:
                    eq: '500'
                    field: http.response.status_code
      responses:
        '200':
          description: The stream was forked successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{name}/_ingest':
    get:
      tags:
        - streams
      summary: Get ingest stream settings
      description: 'Fetches the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-ingest
      parameters:
        - name: name
          in: path
          description: The name of the stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: Ingest settings for the stream.
          content:
            application/json:
              examples:
                getWiredIngest:
                  value:
                    ingest:
                      failure_store:
                        inherit: { }
                      lifecycle:
                        inherit: { }
                      processing:
                        steps:
                          - action: grok
                            from: message
                            ignore_missing: false
                            patterns:
                              - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                        updated_at: '2025-01-15T10:30:00.000Z'
                      settings: { }
                      wired:
                        fields:
                          client.ip:
                            type: ip
                          http.method:
                            type: keyword
                          http.response.body.bytes:
                            type: long
                          http.response.status_code:
                            type: long
                          url.original:
                            type: wildcard
                        routing:
                          - destination: logs.nginx.errors
                            status: enabled
                            where:
                              field: http.response.status_code
                              gte: 500
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - streams
      summary: Update ingest stream settings
      description: 'Upserts the ingest settings of an ingest stream definition<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-ingest
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ingest
              type: object
              properties:
                ingest:
                  anyOf:
                    - required:
                        - lifecycle
                        - processing
                        - settings
                        - failure_store
                        - wired
                      type: object
                      properties:
                        failure_store:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                        lifecycle:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                        processing:
                          required:
                            - steps
                          type: object
                          properties:
                            steps:
                              type: array
                              items:
                                $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                          additionalProperties: false
                        settings:
                          type: object
                          properties:
                            index.number_of_replicas:
                              required:
                                - value
                              type: object
                              properties:
                                value:
                                  type: number
                              additionalProperties: false
                            index.number_of_shards:
                              required:
                                - value
                              type: object
                              properties:
                                value:
                                  type: number
                              additionalProperties: false
                            index.refresh_interval:
                              required:
                                - value
                              type: object
                              properties:
                                value:
                                  anyOf:
                                    - type: string
                                    - enum:
                                        - -1
                                      type: number
                              additionalProperties: false
                          additionalProperties: false
                        wired:
                          required:
                            - fields
                            - routing
                          type: object
                          properties:
                            draft:
                              type: boolean
                            fields:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinition'
                            routing:
                              type: array
                              items:
                                required:
                                  - destination
                                  - where
                                type: object
                                properties:
                                  destination:
                                    minLength: 1
                                    type: string
                                    description: A non-empty string.
                                  draft:
                                    type: boolean
                                  status:
                                    enum:
                                      - enabled
                                      - disabled
                                    type: string
                                  where:
                                    $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                          additionalProperties: false
                      additionalProperties: false
                    - required:
                        - lifecycle
                        - processing
                        - settings
                        - failure_store
                        - classic
                      type: object
                      properties:
                        classic:
                          type: object
                          properties:
                            field_overrides:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinition'
                          additionalProperties: false
                        failure_store:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                        lifecycle:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                        processing:
                          anyOf:
                            - required:
                                - steps
                              type: object
                              properties:
                                steps:
                                  type: array
                                  items:
                                    $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                              additionalProperties: false
                            - required:
                                - processors
                              type: object
                              properties:
                                processors:
                                  type: array
                                  items:
                                    type: object
                                    additionalProperties: { }
                              additionalProperties: false
                        settings:
                          type: object
                          properties:
                            index.number_of_replicas:
                              required:
                                - value
                              type: object
                              properties:
                                value:
                                  type: number
                              additionalProperties: false
                            index.number_of_shards:
                              required:
                                - value
                              type: object
                              properties:
                                value:
                                  type: number
                              additionalProperties: false
                            index.refresh_interval:
                              required:
                                - value
                              type: object
                              properties:
                                value:
                                  anyOf:
                                    - type: string
                                    - enum:
                                        - -1
                                      type: number
                              additionalProperties: false
                          additionalProperties: false
                      additionalProperties: false
              additionalProperties: false
            examples:
              upsertWiredIngest:
                value:
                  ingest:
                    failure_store:
                      inherit: { }
                    lifecycle:
                      inherit: { }
                    processing:
                      steps:
                        - action: grok
                          from: message
                          ignore_missing: false
                          patterns:
                            - '%{IPORHOST:client.ip} %{USER:ident} %{USER:auth} \[%{HTTPDATE:@timestamp}\] "%{WORD:http.method} %{DATA:url.original} HTTP/%{NUMBER:http.version}" %{NUMBER:http.response.status_code:int} (?:%{NUMBER:http.response.body.bytes:int}|-)'
                    settings: { }
                    wired:
                      fields:
                        client.ip:
                          type: ip
                        http.method:
                          type: keyword
                        http.response.body.bytes:
                          type: long
                        http.response.status_code:
                          type: long
                        url.original:
                          type: wildcard
                      routing:
                        - destination: logs.nginx.errors
                          status: enabled
                          where:
                            eq: '500'
                            field: http.response.status_code
      responses:
        '200':
          description: The ingest settings were updated successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{name}/_query':
    get:
      tags:
        - streams
      summary: Get query stream settings
      description: 'Fetches the query settings of a query stream definition<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-name-query
      parameters:
        - name: name
          in: path
          description: The name of the query stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
      responses:
        '200':
          description: Query settings for the stream.
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - streams
      summary: Upsert query stream settings
      description: 'Upserts the query settings of a query stream definition<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-name-query
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the query stream.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - query
              type: object
              properties:
                field_descriptions:
                  type: object
                  additionalProperties:
                    maxLength: 1000
                    type: string
                query:
                  required:
                    - esql
                  type: object
                  properties:
                    esql:
                      maxLength: 65535
                      type: string
                  additionalProperties: false
              additionalProperties: false
            examples:
              upsertQueryStream:
                value:
                  query:
                    esql: 'FROM logs* | WHERE log.level == "error" | KEEP @timestamp, message, host.name, log.level'
      responses:
        '200':
          description: The query stream settings were updated successfully.
      x-state: Experimental; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{name}/content/export':
    post:
      tags:
        - streams
      summary: Export stream content
      description: 'Exports a content pack with the stream structure (routing, mappings, and processing). Significant-event queries are not included.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-content-export
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the stream to export content from.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - name
                - description
                - version
                - include
              type: object
              properties:
                description:
                  maxLength: 1000
                  type: string
                include:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs__zod_v4_55___schema0'
                name:
                  maxLength: 256
                  type: string
                version:
                  maxLength: 100
                  type: string
              additionalProperties: false
            examples:
              exportContent:
                value:
                  description: Nginx stream content pack
                  include:
                    objects:
                      all: { }
                  name: nginx-pack
                  version: 1.0.0
      responses:
        '200':
          description: Content pack archive for the stream.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{name}/content/import':
    post:
      tags:
        - streams
      summary: Import content into a stream
      description: 'Imports stream structure (routing, mappings, and processing) from a content pack into a stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-name-content-import
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: name
          in: path
          description: The name of the stream to import content into.
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          multipart/form-data:
            schema:
              required:
                - include
                - content
              type: object
              properties:
                content: { }
                include:
                  maxLength: 5242880
                  type: string
              additionalProperties: false
            examples:
              importContent:
                value:
                  content: <binary zip archive>
                  include: '{"objects":{"all":{}}}'
      responses:
        '200':
          description: Content was imported into the stream successfully.
      x-state: Experimental; added in 9.1.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{streamName}/attachments':
    get:
      tags:
        - streams
      summary: Get stream attachments
      description: 'Fetches all attachments linked to a stream that are visible to the current user in the current space. Optionally filter by attachment types, search query, and tags.<br/><br/>[Required authorization] Route required privileges: read_stream.'
      operationId: get-streams-streamname-attachments
      parameters:
        - name: streamName
          in: path
          description: The name of the stream
          required: true
          schema:
            maxLength: 200
            type: string
        - name: query
          in: query
          description: Search query to filter attachments by title
          schema:
            maxLength: 1000
            type: string
        - name: attachmentTypes
          in: query
          description: Filter by attachment types (single value or array)
          schema:
            maxItems: 3
            type: array
            items:
              enum:
                - dashboard
                - rule
                - slo
              type: string
        - name: tags
          in: query
          description: Filter by tags (single value or array)
          schema:
            maxItems: 100
            type: array
            items:
              maxLength: 256
              type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
            examples:
              listAttachmentsExample:
                value: { }
      responses:
        '200':
          description: Successfully retrieved attachments
          content:
            application/json:
              examples:
                listAttachmentsResponse:
                  value:
                    attachments:
                      - createdAt: '2023-02-23T16:15:47.275Z'
                        description: Dashboard for monitoring production services
                        id: dashboard-123
                        streamNames:
                          - logs.awsfirehose
                          - logs.nginx
                        tags:
                          - monitoring
                          - production
                        title: My Dashboard
                        type: dashboard
                        updatedAt: '2023-03-24T14:39:17.636Z'
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{streamName}/attachments/_bulk':
    post:
      tags:
        - streams
      summary: Bulk update attachments
      description: 'Bulk update attachments linked to a stream. Can link new attachments and delete existing ones. Supports mixed attachment types in a single request.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: post-streams-streamname-attachments-bulk
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: streamName
          in: path
          description: The name of the stream
          required: true
          schema:
            maxLength: 200
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - operations
              type: object
              properties:
                operations:
                  maxItems: 1000
                  type: array
                  items:
                    anyOf:
                      - required:
                          - index
                        type: object
                        properties:
                          index:
                            required:
                              - id
                              - type
                            type: object
                            properties:
                              id:
                                maxLength: 256
                                type: string
                              type:
                                enum:
                                  - dashboard
                                  - rule
                                  - slo
                                type: string
                      - required:
                          - delete
                        type: object
                        properties:
                          delete:
                            required:
                              - id
                              - type
                            type: object
                            properties:
                              id:
                                maxLength: 256
                                type: string
                              type:
                                enum:
                                  - dashboard
                                  - rule
                                  - slo
                                type: string
              additionalProperties: false
            examples:
              bulkAttachmentsExample:
                value:
                  operations:
                    - index:
                        id: dashboard-123
                        type: dashboard
                    - delete:
                        id: rule-456
                        type: rule
      responses:
        '200':
          description: Successfully performed bulk operations
          content:
            application/json:
              examples:
                bulkAttachmentsResponse:
                  value:
                    acknowledged: true
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/streams/{streamName}/attachments/{attachmentType}/{attachmentId}':
    delete:
      tags:
        - streams
      summary: Unlink an attachment from a stream
      description: 'Unlinks an attachment from a stream. Noop if the attachment is not linked to the stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: delete-streams-streamname-attachments-attachmenttype-attachmentid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: streamName
          in: path
          description: The name of the stream
          required: true
          schema:
            maxLength: 200
            type: string
        - name: attachmentType
          in: path
          description: The type of the attachment
          required: true
          schema:
            enum:
              - dashboard
              - rule
              - slo
            type: string
        - name: attachmentId
          in: path
          description: The ID of the attachment
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
            examples:
              unlinkAttachmentExample:
                value: { }
      responses:
        '200':
          description: Successfully unlinked attachment
          content:
            application/json:
              examples:
                unlinkAttachmentResponse:
                  value:
                    acknowledged: true
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - streams
      summary: Link an attachment to a stream
      description: 'Links an attachment to a stream. Noop if the attachment is already linked to the stream.<br/><br/>[Required authorization] Route required privileges: manage_stream.'
      operationId: put-streams-streamname-attachments-attachmenttype-attachmentid
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: streamName
          in: path
          description: The name of the stream
          required: true
          schema:
            maxLength: 200
            type: string
        - name: attachmentType
          in: path
          description: The type of the attachment
          required: true
          schema:
            enum:
              - dashboard
              - rule
              - slo
            type: string
        - name: attachmentId
          in: path
          description: The ID of the attachment
          required: true
          schema:
            maxLength: 256
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - type: object
                  additionalProperties: false
                - { }
            examples:
              linkAttachmentExample:
                value: { }
      responses:
        '200':
          description: Successfully linked attachment
          content:
            application/json:
              examples:
                linkAttachmentResponse:
                  value:
                    acknowledged: true
      x-state: Experimental; added in 9.3.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/synthetics/monitor/test/{monitorId}':
    post:
      tags:
        - synthetics
      summary: Trigger an on-demand test run for a monitor
      description: "Trigger an immediate test execution for the specified monitor. The response includes the generated `testRunId`. If the test encounters issues in one or more service locations, an `errors` array is also returned with details about the failures.\n"
      operationId: post-synthetics-monitor-test
      parameters:
        - name: monitorId
          in: path
          description: The ID (config_id) of the monitor to test.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Test run triggered successfully.
          content:
            application/json:
              schema:
                required:
                  - testRunId
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      required:
                        - locationId
                        - error
                      type: object
                      properties:
                        error:
                          required:
                            - status
                            - reason
                            - failed_monitors
                          type: object
                          properties:
                            failed_monitors:
                              type:
                                - 'null'
                                - array
                              items:
                                type: object
                              description: Optional list of monitors that failed at the location.
                            reason:
                              type: string
                              description: Human-readable explanation of the failure.
                            status:
                              type: integer
                              description: HTTP status code returned by the agent.
                        locationId:
                          type: string
                          description: Identifier of the service location where the error occurred.
                    description: 'Array of errors encountered while triggering the test, one per service location.'
                  testRunId:
                    type: string
                    description: Unique identifier for the triggered test run.
              examples:
                testNowMonitorResponseExample1:
                  value: "{\n  \"testRunId\": \"2bd506e5-4f9a-4aa6-a019-7988500afba0\",\n  \"errors\": [\n    {\n      \"locationId\": \"us_central_staging\",\n      \"error\": {\n        \"status\": 401,\n        \"reason\": \"no auth credentials provided\",\n        \"failed_monitors\": null\n      }\n    }\n  ]\n}"
        '404':
          description: Monitor not found.
      x-state: Generally available; added in 9.2.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/synthetics/monitors:
    get:
      tags:
        - synthetics
      summary: Get monitors
      description: "Get a list of monitors.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: get-synthetic-monitors
      parameters:
        - name: filter
          in: query
          description: Additional filtering criteria.
          schema:
            type: string
        - name: locations
          in: query
          description: The locations to filter by.
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
        - name: monitorTypes
          in: query
          description: The monitor types to filter.
          schema:
            oneOf:
              - enum:
                  - browser
                  - http
                  - icmp
                  - tcp
                type: string
              - type: array
                items:
                  enum:
                    - browser
                    - http
                    - icmp
                    - tcp
                  type: string
        - name: page
          in: query
          description: The page number for paginated results.
          schema:
            type: integer
        - name: per_page
          in: query
          description: The number of items to return per page.
          schema:
            type: integer
        - name: projects
          in: query
          description: The projects to filter by.
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
        - name: query
          in: query
          description: A free-text query string.
          schema:
            type: string
        - name: schedules
          in: query
          description: The schedules to filter by.
          schema:
            oneOf:
              - type: array
                items:
                  type: string
              - type: string
        - name: sortField
          in: query
          description: The field to sort the results by.
          schema:
            enum:
              - name
              - createdAt
              - updatedAt
              - status
            type: string
        - name: sortOrder
          in: query
          description: The sort order.
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: status
          in: query
          description: The status to filter by.
          schema:
            oneOf:
              - type: array
                items:
                  type: string
              - type: string
        - name: tags
          in: query
          description: Tags to filter monitors.
          schema:
            oneOf:
              - type: string
              - type: array
                items:
                  type: string
        - name: useLogicalAndFor
          in: query
          description: "Specifies whether to apply logical AND filtering for specific fields. Accepts either a string with values \"tags\" or \"locations\" or an array containing both.\n"
          schema:
            oneOf:
              - enum:
                  - tags
                  - locations
                type: string
              - type: array
                items:
                  enum:
                    - tags
                    - locations
                  type: string
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
              examples:
                getSyntheticMonitorsResponseExample1:
                  description: A successful response from `GET /api/synthetics/monitors?tags=prod&monitorTypes=http&locations=us-east-1&projects=project1&status=up`.
                  value: "{\n    \"page\": 1,\n    \"total\": 24,\n    \"monitors\": [\n        {\n            \"type\": \"icmp\",\n            \"enabled\": false,\n            \"alert\": {\n                \"status\": {\n                    \"enabled\": true\n                },\n                \"tls\": {\n                    \"enabled\": true\n                }\n            },\n            \"schedule\": {\n                \"number\": \"3\",\n                \"unit\": \"m\"\n            },\n            \"config_id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n            \"timeout\": \"16\",\n            \"name\": \"8.8.8.8:80\",\n            \"locations\": [\n                {\n                    \"id\": \"us_central\",\n                    \"label\": \"North America - US Central\",\n                    \"geo\": {\n                        \"lat\": 41.25,\n                        \"lon\": -95.86\n                    },\n                    \"isServiceManaged\": true\n                }\n            ],\n            \"namespace\": \"default\",\n            \"origin\": \"ui\",\n            \"id\": \"e59142e5-1fe3-4aae-b0b0-19d6345e65a1\",\n            \"max_attempts\": 2,\n            \"wait\": \"7\",\n            \"revision\": 3,\n            \"mode\": \"all\",\n            \"ipv4\": true,\n            \"ipv6\": true,\n            \"created_at\": \"2023-11-07T09:57:04.152Z\",\n            \"updated_at\": \"2023-12-04T19:19:34.039Z\",\n            \"host\": \"8.8.8.8:80\"\n        }\n    ],\n    \"absoluteTotal\": 24,\n    \"perPage\": 10,\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - synthetics
      summary: Create a monitor
      description: "Create a new monitor with the specified attributes. A monitor can be one of the following types: HTTP, TCP, ICMP, or Browser. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: post-synthetic-monitors
      requestBody:
        content:
          application/json:
            schema:
              oneOf:
                - $ref: '#/components/schemas/Synthetics_browserMonitorFields'
                - $ref: '#/components/schemas/Synthetics_httpMonitorFields'
                - $ref: '#/components/schemas/Synthetics_icmpMonitorFields'
                - $ref: '#/components/schemas/Synthetics_tcpMonitorFields'
              description: "The request body should contain the attributes of the monitor you want to create. The required and default fields differ depending on the monitor type.\n"
              discriminator:
                propertyName: type
            examples:
              postSyntheticMonitorsRequestExample1:
                summary: HTTP monitor
                description: Create an HTTP monitor to check a website's availability.
                value: "{\n  \"type\": \"http\",\n  \"name\": \"Website Availability\",\n  \"url\": \"https://example.com\",\n  \"tags\": [\"website\", \"availability\"],\n  \"locations\": [\"united_kingdom\"]\n}"
              postSyntheticMonitorsRequestExample2:
                summary: TCP monitor
                description: Create a TCP monitor to monitor a server's availability.
                value: "{\n  \"type\": \"tcp\",\n  \"name\": \"Server Availability\",\n  \"host\": \"example.com\",\n  \"private_locations\": [\"my_private_location\"]\n}"
              postSyntheticMonitorsRequestExample3:
                summary: ICMP monitor
                description: Create an ICMP monitor to perform ping checks.
                value: "{\n  \"type\": \"icmp\",\n  \"name\": \"Ping Test\",\n  \"host\": \"example.com\",\n  \"locations\": [\"united_kingdom\"]\n}"
              postSyntheticMonitorsRequestExample4:
                summary: Browser monitor
                description: Create a browser monitor to check a website.
                value: "{\n  \"type\": \"browser\",\n  \"name\": \"Example journey\",\n  \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n  \"locations\": [\"united_kingdom\"]\n}"
        required: true
      responses:
        '200':
          description: "A successful response. The response may include a `warnings` array when the monitor configuration has non-critical issues. For example, if a browser monitor specifies a timeout but has no private locations configured, a warning is returned indicating the timeout will have no effect.\n"
          content:
            application/json:
              schema:
                type: object
                properties:
                  warnings:
                    type: array
                    items:
                      $ref: '#/components/schemas/Synthetics_monitorWarning'
                    description: "An optional array of warnings about the monitor configuration.\n"
              examples:
                postSyntheticMonitorsResponseWithWarning:
                  summary: Response with warning
                  description: A response when a browser monitor specifies a timeout but has no private locations.
                  value: "{\n  \"type\": \"browser\",\n  \"name\": \"Example journey\",\n  \"enabled\": true,\n  \"warnings\": [\n    {\n      \"id\": \"monitor-id\",\n      \"message\": \"For browser monitors, timeout is only supported on private locations. Browser monitor \\\"Example journey\\\" specifies a timeout and is running on public locations: \\\"public-1, public-2\\\". The timeout will have no effect on these locations.\",\n      \"publicLocationIds\": [\"public-1\", \"public-2\"]\n    }\n  ]\n}"
        '400':
          description: "Bad request. For browser monitors, a 400 error is returned if the timeout is less than 30 seconds.\n"
          content:
            application/json:
              schema:
                type: object
                properties:
                  attributes:
                    type: object
                    properties:
                      details:
                        type: string
                        example: Invalid timeout 20 seconds supplied. Minimum timeout for browser monitors is 30 seconds.
                  error:
                    type: string
                    example: Bad Request
                  message:
                    type: string
                    example: Browser Monitor timeout is invalid
                  statusCode:
                    type: integer
                    example: 400
              examples:
                invalidBrowserTimeout:
                  summary: Invalid browser timeout
                  description: A 400 error when a browser monitor timeout is below 30 seconds.
                  value: "{\n  \"statusCode\": 400,\n  \"error\": \"Bad Request\",\n  \"message\": \"Browser Monitor timeout is invalid\",\n  \"attributes\": {\n    \"details\": \"Invalid timeout 20 seconds supplied. Minimum timeout for browser monitors is 30 seconds.\"\n  }\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/synthetics/monitors/_bulk_delete:
    post:
      tags:
        - synthetics
      summary: Delete monitors
      description: "Delete multiple monitors by sending a list of config IDs.\n"
      operationId: delete-synthetic-monitors
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ids
              type: object
              properties:
                ids:
                  type: array
                  items:
                    type: string
                  description: An array of monitor IDs to delete.
            examples:
              bulkDeleteRequestExample1:
                description: Run `POST /api/synthetics/monitors/_bulk_delete` to delete a list of monitors.
                value: "{\n  \"ids\": [\n    \"monitor1-id\",\n    \"monitor2-id\"\n  ]\n}"
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    deleted:
                      type: boolean
                      description: "If it is `true`, the monitor was successfully deleted If it is `false`, the monitor was not deleted.\n"
                    ids:
                      type: string
                      description: The unique identifier of the deleted monitor.
                  description: The API response includes information about the deleted monitors.
              examples:
                deleteMonitorsResponseExample1:
                  description: A response from successfully deleting multiple monitors.
                  value: "[\n  {\n    \"id\": \"monitor1-id\",\n    \"deleted\": true\n  },\n  {\n    \"id\": \"monitor2-id\",\n    \"deleted\": true\n  }\n]"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/synthetics/monitors/_bulk_update:
    put:
      tags:
        - synthetics
      summary: Bulk update monitors
      description: "Partially update multiple monitors in a single request.\nEach `updates` entry has its own `id` and `attributes` patch, so one request can apply a different change per monitor. Unspecified fields are left unchanged. Patches use the same merge, validate, and encrypt path as `PUT /api/synthetics/monitors/{id}`.\nFor private-location monitors, Fleet is synced once for the batch instead of once per monitor.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\nThis is a versioned public API (`elastic-api-version: 2023-10-31`).\n"
      operationId: put-synthetic-monitors-bulk-update
      requestBody:
        content:
          application/json:
            schema:
              required:
                - updates
              type: object
              properties:
                updates:
                  maxItems: 1000
                  minItems: 1
                  type: array
                  items:
                    required:
                      - id
                      - attributes
                    type: object
                    properties:
                      attributes:
                        minProperties: 1
                        type: object
                        description: "Attributes to update for the monitor. You can specify the same fields as in `PUT /api/synthetics/monitors/{id}`. An empty object is rejected.\n"
                      id:
                        maxLength: 1024
                        minLength: 1
                        type: string
                        description: The monitor config ID to update.
                    additionalProperties: false
                  description: "Monitors to update. Minimum 1 entry, maximum 1000. Each `id` may appear at most once. `attributes` must contain at least one field.\n"
              additionalProperties: false
            examples:
              bulkUpdateRequestExample1:
                summary: Mixed patches
                description: "Run `PUT /api/synthetics/monitors/_bulk_update` to apply a different partial update to each monitor.\n"
                value: "{\n  \"updates\": [\n    {\n      \"id\": \"monitor1-id\",\n      \"attributes\": {\n        \"enabled\": false\n      }\n    },\n    {\n      \"id\": \"monitor2-id\",\n      \"attributes\": {\n        \"tags\": [\"bulk-patched\"]\n      }\n    },\n    {\n      \"id\": \"monitor3-id\",\n      \"attributes\": {\n        \"schedule\": {\n          \"number\": \"15\",\n          \"unit\": \"m\"\n        }\n      }\n    }\n  ]\n}"
        required: true
      responses:
        '200':
          description: "A successful response. The `result` array is in request order. Per-id failures (not found, validation, Fleet sync) set `updated: false` and `error` without failing the whole batch. `errors` is present only when there are service-level sync errors.\n"
          content:
            application/json:
              schema:
                required:
                  - result
                type: object
                properties:
                  errors:
                    type: array
                    items:
                      description: A service-level error from the bulk sync.
                    description: Optional service-level errors from the bulk sync.
                  result:
                    type: array
                    items:
                      required:
                        - id
                        - updated
                      type: object
                      properties:
                        error:
                          type: string
                          description: Present when `updated` is `false`.
                        id:
                          type: string
                          description: The monitor config ID from the request.
                        updated:
                          type: boolean
                          description: "If `true`, the monitor was updated. If `false`, see `error`.\n"
              examples:
                bulkUpdateResponseExample1:
                  description: A response from a bulk update with one failure.
                  value: "{\n  \"result\": [\n    {\n      \"id\": \"monitor1-id\",\n      \"updated\": true\n    },\n    {\n      \"id\": \"missing-id\",\n      \"updated\": false,\n      \"error\": \"Monitor id missing-id not found!\"\n    },\n    {\n      \"id\": \"monitor3-id\",\n      \"updated\": true\n    }\n  ]\n}"
        '400':
          description: "Bad request. Returned when `updates` is missing or empty, an `attributes` object is empty, or the same `id` appears more than once.\n"
      x-state: added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/synthetics/monitors/{id}':
    delete:
      tags:
        - synthetics
      summary: Delete a monitor
      description: "Delete a monitor from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: delete-synthetic-monitor
      parameters:
        - name: id
          in: path
          description: The identifier for the monitor that you want to delete.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - synthetics
      summary: Get a monitor
      operationId: get-synthetic-monitor
      parameters:
        - name: id
          in: path
          description: The ID of the monitor.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
              examples:
                getSyntheticMonitorResponseExample1:
                  description: A successful response from `GET /api/synthetics/monitors/<id>`.
                  value: "{\n    \"type\": \"http\",\n    \"enabled\": true,\n    \"alert\": {\n        \"status\": {\n            \"enabled\": true\n        },\n        \"tls\": {\n            \"enabled\": true\n        }\n    },\n    \"schedule\": {\n        \"number\": \"3\",\n        \"unit\": \"m\"\n    },\n    \"config_id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n    \"timeout\": \"16\",\n    \"name\": \"am i something\",\n    \"locations\": [\n        {\n            \"id\": \"us_central\",\n            \"label\": \"North America - US Central\",\n            \"geo\": {\n                \"lat\": 41.25,\n                \"lon\": -95.86\n            },\n            \"isServiceManaged\": true\n        }\n    ],\n    \"namespace\": \"default\",\n    \"origin\": \"ui\",\n    \"id\": \"a8188705-d01e-4bb6-87a1-64fa5e4b07ec\",\n    \"max_attempts\": 2,\n    \"__ui\": {\n        \"is_tls_enabled\": false\n    },\n    \"max_redirects\": \"0\",\n    \"response.include_body\": \"on_error\",\n    \"response.include_headers\": true,\n    \"check.request.method\": \"GET\",\n    \"mode\": \"any\",\n    \"response.include_body_max_bytes\": \"1024\",\n    \"ipv4\": true,\n    \"ipv6\": true,\n    \"ssl.verification_mode\": \"full\",\n    \"ssl.supported_protocols\": [\n        \"TLSv1.1\",\n        \"TLSv1.2\",\n        \"TLSv1.3\"\n    ],\n    \"revision\": 13,\n    \"created_at\": \"2023-11-08T08:45:29.334Z\",\n    \"updated_at\": \"2023-12-18T20:31:44.770Z\",\n    \"url\": \"https://fast.com\"\n}"
        '404':
          description: 'If the monitor is not found, the API returns a 404 error.'
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - synthetics
      summary: Update a monitor
      description: "Update a monitor with the specified attributes. The required and default fields may vary based on the monitor type.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\nYou can also partially update a monitor. This will only update the fields that are specified in the request body. All other fields are left unchanged. The specified fields should conform to the monitor type. For example, you can't update the `inline_scipt` field of a HTTP monitor.\n"
      operationId: put-synthetic-monitor
      parameters:
        - name: id
          in: path
          description: The identifier for the monitor that you want to update.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              oneOf:
                - $ref: '#/components/schemas/Synthetics_browserMonitorFields'
                - $ref: '#/components/schemas/Synthetics_httpMonitorFields'
                - $ref: '#/components/schemas/Synthetics_icmpMonitorFields'
                - $ref: '#/components/schemas/Synthetics_tcpMonitorFields'
              description: "The request body should contain the attributes of the monitor you want to update. The required and default fields differ depending on the monitor type.\n"
              discriminator:
                propertyName: type
            examples:
              putSyntheticMonitorsRequestExample1:
                summary: HTTP monitor
                description: Update an HTTP monitor that checks a website's availability.
                value: "{\n  \"type\": \"http\",\n  \"name\": \"Website Availability\",\n  \"url\": \"https://example.com\",\n  \"tags\": [\"website\", \"availability\"],\n  \"locations\": [\"united_kingdom\"]\n}"
              putSyntheticMonitorsRequestExample2:
                summary: TCP monitor
                description: Update a TCP monitor that monitors a server's availability.
                value: "{\n  \"type\": \"tcp\",\n  \"name\": \"Server Availability\",\n  \"host\": \"example.com\",\n  \"private_locations\": [\"my_private_location\"]\n}"
              putSyntheticMonitorsRequestExample3:
                summary: ICMP monitor
                description: Update an ICMP monitor that performs ping checks.
                value: "{\n  \"type\": \"icmp\",\n  \"name\": \"Ping Test\",\n  \"host\": \"example.com\",\n  \"locations\": [\"united_kingdom\"]\n}"
              putSyntheticMonitorsRequestExample4:
                summary: Browser monitor
                description: Update a browser monitor that checks a website.
                value: "{\n  \"type\": \"browser\",\n  \"name\": \"Example journey\",\n  \"inline_script\": \"step('Go to https://google.com.co', () => page.goto('https://www.google.com'))\",\n  \"locations\": [\"united_kingdom\"]\n}"
        required: true
      responses:
        '200':
          description: "A successful response. The response may include a `warnings` array when the monitor configuration has non-critical issues.\n"
          content:
            application/json:
              schema:
                type: object
                properties:
                  warnings:
                    type: array
                    items:
                      $ref: '#/components/schemas/Synthetics_monitorWarning'
                    description: "An optional array of warnings about the monitor configuration.\n"
              examples:
                putSyntheticMonitorResponseWithWarning:
                  summary: Response with warning
                  description: A response when a browser monitor specifies a timeout but has no private locations.
                  value: "{\n  \"type\": \"browser\",\n  \"name\": \"Example journey\",\n  \"enabled\": true,\n  \"warnings\": [\n    {\n      \"id\": \"monitor-id\",\n      \"message\": \"For browser monitors, timeout is only supported on private locations. Browser monitor \\\"Example journey\\\" specifies a timeout and is running on public locations: \\\"public-1, public-2\\\". The timeout will have no effect on these locations.\",\n      \"publicLocationIds\": [\"public-1\", \"public-2\"]\n    }\n  ]\n}"
        '400':
          description: "Bad request. For browser monitors, a 400 error is returned if the timeout is less than 30 seconds.\n"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/synthetics/params:
    get:
      tags:
        - synthetics
      summary: Get parameters
      description: "Get a list of all parameters. You must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: get-parameters
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Synthetics_getParameterResponse'
              examples:
                getParametersResponseExample1:
                  summary: Read access
                  description: A successful response for a user with read-only permissions to get a list of parameters.
                  value: "[\n  {\n    \"id\": \"param1-id\",\n    \"key\": \"param1\",\n    \"description\": \"Description for param1\",\n    \"tags\": [\"tag1\", \"tag2\"],\n    \"namespaces\": [\"namespace1\"]\n  },\n  {\n    \"id\": \"param2-id\",\n    \"key\": \"param2\",\n    \"description\": \"Description for param2\",\n    \"tags\": [\"tag3\"],\n    \"namespaces\": [\"namespace2\"]\n  }\n]"
                getParametersResponseExample2:
                  summary: Write access
                  description: A successful response for a user with write permissions to get a list of parameters.
                  value: "[\n  {\n    \"id\": \"param1-id\",\n    \"key\": \"param1\",\n    \"description\": \"Description for param1\",\n    \"tags\": [\"tag1\", \"tag2\"],\n    \"namespaces\": [\"namespace1\"],\n    \"value\": \"value1\"\n  },\n  {\n    \"id\": \"param2-id\",\n    \"key\": \"param2\",\n    \"description\": \"Description for param2\",\n    \"tags\": [\"tag3\"],\n    \"namespaces\": [\"namespace2\"],\n    \"value\": \"value2\"\n  }\n]"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - synthetics
      summary: Add parameters
      description: "Add one or more parameters to the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: post-parameters
      requestBody:
        description: The request body can contain either a single parameter object or an array of parameter objects.
        content:
          application/json:
            schema:
              oneOf:
                - type: array
                  items:
                    $ref: '#/components/schemas/Synthetics_parameterRequest'
                - $ref: '#/components/schemas/Synthetics_parameterRequest'
            examples:
              postParametersRequestExample1:
                summary: Single parameter
                description: Add a single parameter.
                value: "{\n  \"key\": \"your-key-name\",\n  \"value\": \"your-parameter-value\",\n  \"description\": \"Param to use in browser monitor\",\n  \"tags\": [\"authentication\", \"security\"],\n  \"share_across_spaces\": true\n}"
              postParametersRequestExample2:
                summary: Multiple parameters
                description: Add multiple parameters.
                value: "[\n  {\n    \"key\": \"param1\",\n    \"value\": \"value1\"\n  },\n  {\n    \"key\": \"param2\",\n    \"value\": \"value2\"\n  }\n]"
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                oneOf:
                  - type: array
                    items:
                      $ref: '#/components/schemas/Synthetics_postParameterResponse'
                  - $ref: '#/components/schemas/Synthetics_postParameterResponse'
              examples:
                postParametersResponseExample1:
                  summary: Single parameter
                  description: A successful response for a single added parameter.
                  value: "{\n  \"id\": \"unique-parameter-id\",\n  \"key\": \"your-key-name\",\n  \"value\": \"your-param-value\",\n  \"description\": \"Param to use in browser monitor\",\n  \"tags\": [\"authentication\", \"security\"],\n  \"share_across_spaces\": true\n}"
                postParametersResponseExample2:
                  summary: Multiple parameters
                  description: A successful response for multiple added parameters.
                  value: "[\n  {\n    \"id\": \"param1-id\",\n    \"key\": \"param1\",\n    \"value\": \"value1\"\n  },\n  {\n    \"id\": \"param2-id\",\n    \"key\": \"param2\",\n    \"value\": \"value2\"\n  }\n]"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/synthetics/params/_bulk_delete:
    post:
      tags:
        - synthetics
      summary: Delete parameters
      description: "Delete parameters from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: delete-parameters
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  type: array
                  items:
                    type: string
                  description: An array of parameter IDs to delete.
            examples:
              deleteParametersRequestExample1:
                description: Run `POST /api/synthetics/params/_bulk_delete` to delete multiple parameters.
                value: "{\n  \"ids\": [\"param1-id\", \"param2-id\"]\n}"
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: array
                items:
                  type: object
                  properties:
                    deleted:
                      type: boolean
                      description: "Indicates whether the parameter was successfully deleted. It is `true` if it was deleted. It is `false` if it was not deleted.\n"
                    id:
                      type: string
                      description: The unique identifier for the deleted parameter.
              examples:
                deleteParametersResponseExample1:
                  value: "[\n  {\n    \"id\": \"param1-id\",\n    \"deleted\": true\n  }\n]"
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/synthetics/params/{id}':
    delete:
      tags:
        - synthetics
      summary: Delete a parameter
      description: "Delete a parameter from the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: delete-parameter
      parameters:
        - name: id
          in: path
          description: The ID for the parameter to delete.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: OK
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - synthetics
      summary: Get a parameter
      description: "Get a parameter from the Synthetics app.\nYou must have `read` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: get-parameter
      parameters:
        - name: id
          in: path
          description: The unique identifier for the parameter.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Synthetics_getParameterResponse'
              examples:
                getParameterResponseExample1:
                  summary: Read access
                  description: A successful response for a user with read-only permissions to get a single parameter.
                  value: "{\n  \"id\": \"unique-parameter-id\",\n  \"key\": \"your-api-key\",\n  \"description\": \"Param to use in browser monitor\",\n  \"tags\": [\"authentication\", \"security\"],\n  \"namespaces\": [\"namespace1\", \"namespace2\"]\n}"
                getParameterResponseExample2:
                  summary: Write access
                  description: A successful response for a user with write permissions to get a single parameter.
                  value: "{\n  \"id\": \"unique-parameter-id\",\n  \"key\": \"your-param-key\",\n  \"description\": \"Param to use in browser monitor\",\n  \"tags\": [\"authentication\", \"security\"],\n  \"namespaces\": [\"namespace1\", \"namespace2\"],\n  \"value\": \"your-param-value\"\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - synthetics
      summary: Update a parameter
      description: "Update a parameter in the Synthetics app.\nYou must have `all` privileges for the Synthetics feature in the Observability section of the Kibana feature privileges.\n"
      operationId: put-parameter
      parameters:
        - name: id
          in: path
          description: The unique identifier for the parameter.
          required: true
          schema:
            type: string
      requestBody:
        description: The request body cannot be empty; at least one attribute is required.
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                  description: The updated description of the parameter.
                key:
                  type: string
                  description: The key of the parameter.
                tags:
                  type: array
                  items:
                    type: string
                  description: An array of updated tags to categorize the parameter.
                value:
                  type: string
                  description: The updated value associated with the parameter.
            examples:
              putParameterRequestExample1:
                value: "{\n  \"key\": \"updated_param_key\",\n  \"value\": \"updated-param-value\",\n  \"description\": \"Updated Param to be used in browser monitor\",\n  \"tags\": [\"authentication\", \"security\", \"updated\"]\n}"
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
              examples:
                putParameterResponseExample1:
                  value: "{\n  \"id\": \"param_id1\",\n  \"key\": \"updated_param_key\",\n  \"value\": \"updated-param-value\",\n  \"description\": \"Updated Param to be used in browser monitor\",\n  \"tags\": [\"authentication\", \"security\", \"updated\"]\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/synthetics/private_locations:
    get:
      tags:
        - synthetics
      summary: Get private locations
      description: "Get a list of private locations.\nYou must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n"
      operationId: get-private-locations
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: array
                items:
                  $ref: '#/components/schemas/Synthetics_getPrivateLocation'
              examples:
                getPrivateLocationsResponseExample1:
                  value: "[\n    {\n        \"label\": \"Test private location\",\n        \"id\": \"fleet-server-policy\",\n        \"agentPolicyId\": \"fleet-server-policy\",\n        \"isInvalid\": false,\n        \"geo\": {\n            \"lat\": 0,\n            \"lon\": 0\n        },\n        \"namespace\": \"default\"\n    },\n    {\n        \"label\": \"Test private location 2\",\n        \"id\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n        \"agentPolicyId\": \"691225b0-6ced-11ee-8f5a-376306ee85ae\",\n        \"isInvalid\": false,\n        \"geo\": {\n            \"lat\": 0,\n            \"lon\": 0\n        },\n        \"namespace\": \"test\"\n    }\n]"
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - synthetics
      summary: Create a private location
      description: You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.
      operationId: post-private-location
      requestBody:
        content:
          application/json:
            schema:
              required:
                - agentPolicyId
                - label
              type: object
              properties:
                agentPolicyId:
                  type: string
                  description: The ID of the agent policy associated with the private location.
                geo:
                  required:
                    - lat
                    - lon
                  type: object
                  properties:
                    lat:
                      type: number
                      description: The latitude of the location.
                    lon:
                      type: number
                      description: The longitude of the location.
                  description: Geographic coordinates (WGS84) for the location.
                label:
                  type: string
                  description: A label for the private location.
                spaces:
                  type: array
                  items:
                    type: string
                  description: "An array of space IDs where the private location is available. If it is not provided, the private location is available in all spaces.\n"
                tags:
                  type: array
                  items:
                    type: string
                  description: An array of tags to categorize the private location.
            examples:
              postPrivateLocationRequestExample1:
                description: Run `POST /api/private_locations` to create a private location.
                value: "{\n  \"label\": \"Private Location 1\",\n  \"agentPolicyId\": \"abcd1234\",\n  \"tags\": [\"private\", \"testing\"],\n  \"geo\": {\n    \"lat\": 40.7128,\n    \"lon\": -74.0060\n  }\n  \"spaces\": [\"default\"]\n}"
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                type: object
              examples:
                postPrivateLocationResponseExample1:
                  value: "{\n  \"id\": \"abcd1234\",\n  \"label\": \"Private Location 1\",\n  \"agentPolicyId\": \"abcd1234\",\n  \"tags\": [\"private\", \"testing\"],\n  \"geo\": {\n    \"lat\": 40.7128,\n    \"lon\": -74.0060\n  }\n}"
        '400':
          description: 'If the `agentPolicyId` is already used by an existing private location or if the `label` already exists, the API will return a 400 Bad Request response with a corresponding error message.'
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/synthetics/private_locations/{id}':
    delete:
      tags:
        - synthetics
      summary: Delete a private location
      description: "You must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nThe API does not return a response body for deletion, but it will return an appropriate status code upon successful deletion.\nA location cannot be deleted if it has associated monitors in use. You must delete all monitors associated with the location before deleting the location.\n"
      operationId: delete-private-location
      parameters:
        - name: id
          in: path
          description: The unique identifier of the private location to be deleted.
          required: true
          schema:
            maxLength: 1024
            minLength: 1
            type: string
      responses:
        '200':
          description: OK
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - synthetics
      summary: Get a private location
      description: "You must have `read` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\n"
      operationId: get-private-location
      parameters:
        - name: id
          in: path
          description: A private location identifier or label.
          required: true
          schema:
            type: string
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Synthetics_getPrivateLocation'
              examples:
                getPrivateLocationResponseExample1:
                  value: "{\n    \"label\": \"Test private location\",\n    \"id\": \"test-private-location-id\",\n    \"agentPolicyId\": \"test-private-location-id\",\n    \"isServiceManaged\": false,\n    \"isInvalid\": false,\n    \"geo\": {\n        \"lat\": 0,\n        \"lon\": 0\n    },\n    \"namespace\": \"default\"\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - synthetics
      summary: Update a private location
      description: "Update an existing private location's label.\nYou must have `all` privileges for the Synthetics and Uptime feature in the Observability section of the Kibana feature privileges.\nWhen a private location's label is updated, all monitors using this location will also be updated to maintain data consistency.\n"
      operationId: put-private-location
      parameters:
        - name: id
          in: path
          description: The unique identifier of the private location to be updated.
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - label
              type: object
              properties:
                label:
                  minLength: 1
                  type: string
                  description: A new label for the private location. Must be at least 1 character long.
            examples:
              putPrivateLocationRequestExample1:
                description: Update a private location's label.
                value: "{\n  \"label\": \"Updated Private Location Name\"\n}"
        required: true
      responses:
        '200':
          description: A successful response.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Synthetics_getPrivateLocation'
              examples:
                putPrivateLocationResponseExample1:
                  value: "{\n  \"label\": \"Updated Private Location Name\",\n  \"id\": \"test-private-location-id\",\n  \"agentPolicyId\": \"test-private-location-id\",\n  \"isServiceManaged\": false,\n  \"isInvalid\": false,\n  \"tags\": [\"private\", \"testing\", \"updated\"],\n  \"geo\": {\n    \"lat\": 37.7749,\n    \"lon\": -122.4194\n  },\n  \"spaces\": [\"*\"]\n}"
        '400':
          description: If the `label` is shorter than 1 character the API will return a 400 Bad Request response with a corresponding error message.
        '404':
          description: 'If the private location with the specified ID does not exist, the API will return a 404 Not Found response.'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/tags:
    get:
      tags:
        - Tags
      summary: Search tags
      description: Returns a paginated list of tags matching the optional `query` text.
      operationId: get-tags
      parameters:
        - name: query
          in: query
          description: 'Filters results by `name` and `description` using Elasticsearch [`simple_query_string`](https://www.elastic.co/docs/reference/query-languages/query-dsl/simple-query-string-query) syntax. Multi-word terms require all words to match.'
          schema:
            maxLength: 2048
            type: string
        - name: page
          in: query
          description: The page of results to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of results to return per page.
          schema:
            maximum: 1000
            minimum: 1
            type: number
            default: 20
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - data
                  - meta
                type: object
                properties:
                  data:
                    maxItems: 1000
                    minItems: 0
                    type: array
                    items:
                      required:
                        - id
                        - data
                        - meta
                      type: object
                      properties:
                        data:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes'
                        id:
                          type: string
                          description: The tag ID.
                        meta:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                      additionalProperties: false
                    description: List of tags matching the query.
                  meta:
                    required:
                      - total
                    type: object
                    properties:
                      page:
                        minimum: 1
                        type: number
                        description: The returned page of results.
                        default: 1
                      per_page:
                        maximum: 1000
                        minimum: 1
                        type: number
                        description: The number of results returned per page.
                        default: 20
                      total:
                        type: number
                        description: The total number of results matching the query.
                    additionalProperties: false
                additionalProperties: false
              examples:
                searchTagsResponse:
                  summary: Tags matching a search query
                  value:
                    data:
                      - data:
                          color: '#1BA9F5'
                          description: Dashboards owned by engineering teams.
                          name: Engineering
                        id: tag-engineering
                        meta:
                          created_at: '2026-06-01T12:00:00.000Z'
                          managed: false
                          updated_at: '2026-06-01T12:00:00.000Z'
                          version: WzEsMV0=
                      - data:
                          color: '#54B399'
                          description: Content used by operations teams.
                          name: Operations
                        id: tag-operations
                        meta:
                          created_at: '2026-06-02T09:30:00.000Z'
                          managed: false
                          updated_at: '2026-06-02T09:30:00.000Z'
                          version: WzIsMV0=
                    meta:
                      page: 1
                      per_page: 20
                      total: 2
        '403':
          description: forbidden
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Tags
      summary: Create a tag
      description: Creates a new tag and returns it.
      operationId: post-tags
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-request-attributes'
            examples:
              createTagRequest:
                summary: Create a tag
                value:
                  color: '#F04E98'
                  description: Content related to security investigations.
                  name: Security
      responses:
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes'
                  id:
                    type: string
                    description: The tag ID.
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                createTagResponse:
                  summary: The created tag
                  value:
                    data:
                      color: '#F04E98'
                      description: Content related to security investigations.
                      name: Security
                    id: tag-security
                    meta:
                      created_at: '2026-06-03T14:15:00.000Z'
                      managed: false
                      updated_at: '2026-06-03T14:15:00.000Z'
                      version: WzMsMV0=
        '400':
          description: invalid request
        '403':
          description: forbidden
        '409':
          description: conflict
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/tags/{id}':
    delete:
      tags:
        - Tags
      summary: Delete a tag
      description: Permanently deletes a tag by ID.
      operationId: delete-tags-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The tag ID, as returned by the create or search endpoints.'
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '204':
          description: deleted
        '403':
          description: forbidden
        '404':
          description: not found
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Tags
      summary: Get a tag
      description: Returns a tag by ID.
      operationId: get-tags-id
      parameters:
        - name: id
          in: path
          description: 'The tag ID, as returned by the create or search endpoints.'
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      responses:
        '200':
          description: success
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes'
                  id:
                    type: string
                    description: The tag ID.
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                readTagResponse:
                  summary: The requested tag
                  value:
                    data:
                      color: '#1BA9F5'
                      description: Dashboards owned by engineering teams.
                      name: Engineering
                    id: tag-engineering
                    meta:
                      created_at: '2026-06-01T12:00:00.000Z'
                      managed: false
                      updated_at: '2026-06-01T12:00:00.000Z'
                      version: WzEsMV0=
        '403':
          description: forbidden
        '404':
          description: not found
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Tags
      summary: Upsert a tag
      description: 'Updates a tag if it exists, or creates it at the provided ID.'
      operationId: put-tags-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The tag ID, as returned by the create or search endpoints.'
          required: true
          schema:
            maxLength: 256
            minLength: 1
            type: string
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-request-attributes'
            examples:
              upsertTagRequest:
                summary: Update or create a tag
                value:
                  color: '#006BB4'
                  description: Dashboards and visualizations owned by engineering teams.
                  name: Engineering
      responses:
        '200':
          description: updated
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes'
                  id:
                    type: string
                    description: The tag ID.
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                updateTagResponse:
                  summary: The updated tag
                  value:
                    data:
                      color: '#006BB4'
                      description: Dashboards and visualizations owned by engineering teams.
                      name: Engineering
                    id: tag-engineering
                    meta:
                      created_at: '2026-06-01T12:00:00.000Z'
                      managed: false
                      updated_at: '2026-06-05T16:45:00.000Z'
                      version: WzEsMl0=
        '201':
          description: created
          content:
            application/json:
              schema:
                required:
                  - id
                  - data
                  - meta
                type: object
                properties:
                  data:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-tags-attributes'
                  id:
                    type: string
                    description: The tag ID.
                  meta:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
                additionalProperties: false
              examples:
                upsertTagCreatedResponse:
                  summary: The created tag
                  value:
                    data:
                      color: '#9170B8'
                      description: Content used for compliance reporting.
                      name: Compliance
                    id: tag-compliance
                    meta:
                      created_at: '2026-06-06T10:20:00.000Z'
                      managed: false
                      updated_at: '2026-06-06T10:20:00.000Z'
                      version: WzQsMV0=
        '400':
          description: invalid request
        '403':
          description: forbidden
        '409':
          description: conflict
      x-state: Experimental; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/task_manager/_health:
    get:
      tags:
        - task manager
      summary: Get the task manager health
      description: "Get the health status of the Kibana task manager.\n"
      operationId: task-manager-health
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Task_manager_health_APIs_health_response'
              examples:
                taskManagerHealthResponse1:
                  $ref: '#/components/examples/Task_manager_health_APIs_health_200response'
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline:
    delete:
      tags:
        - Security Timeline API
      summary: Delete Timelines or Timeline templates
      description: Delete one or more Timelines or Timeline templates.
      operationId: DeleteTimelines
      requestBody:
        description: The IDs of the Timelines or Timeline templates to delete.
        content:
          application/json:
            schema:
              required:
                - savedObjectIds
              type: object
              properties:
                savedObjectIds:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                  description: The list of IDs of the Timelines or Timeline templates to delete
                searchIds:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                  description: Saved search IDs that should be deleted alongside the timelines
            examples:
              deleteByIds:
                summary: Delete timelines by saved object id
                value:
                  savedObjectIds:
                    - 15c1929b-0af7-42bd-85a8-56e234cc7c4e
              deleteWithSearches:
                summary: Delete Timelines and their linked saved searches
                value:
                  savedObjectIds:
                    - 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    - 6ce1b592-84e3-4b4a-9552-f189d4b82075
                  searchIds:
                    - 2c1b8f02-9ad6-4e33-8f6a-2c6b7d0a1f11
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                type: object
              examples:
                success:
                  summary: Success
                  value: { }
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Security Timeline API
      summary: Get Timeline or Timeline template details
      description: Get the details of an existing saved Timeline or Timeline template.
      operationId: GetTimeline
      parameters:
        - name: template_timeline_id
          in: query
          description: The `savedObjectId` of the Timeline template to retrieve.
          schema:
            type: string
        - name: id
          in: query
          description: The `savedObjectId` of the Timeline to retrieve.
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
              examples:
                timelineDetail:
                  summary: Timeline detail
                  value:
                    description: User-reported suspicious email
                    noteIds: [ ]
                    pinnedEventIds: [ ]
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: active
                    timelineType: default
                    title: Phishing investigation
                    version: WzE0LDFd
      x-metaTags:
        - content: Kibana
          name: product_name
    patch:
      tags:
        - Security Timeline API
      summary: Update a Timeline
      description: 'Update an existing Timeline. You can update the title, description, date range, pinned events, pinned queries, and/or pinned saved queries of an existing Timeline.'
      operationId: PatchTimeline
      requestBody:
        description: 'The Timeline updates, along with the Timeline ID and version.'
        content:
          application/json:
            schema:
              required:
                - timelineId
                - version
                - timeline
              type: object
              properties:
                timeline:
                  $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
                timelineId:
                  type:
                    - 'null'
                    - string
                  description: The `savedObjectId` of the Timeline or Timeline template that you’re updating.
                  example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                version:
                  type:
                    - 'null'
                    - string
                  description: The version of the Timeline or Timeline template that you’re updating.
                  example: WzE0LDFd
            examples:
              patchTitle:
                summary: Update title
                value:
                  timeline:
                    title: Escalated case review
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  version: WzE0LDFd
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
              examples:
                patched:
                  summary: Updated timeline
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: active
                    timelineType: default
                    title: Escalated case review
                    version: WzE1LDFd
        '405':
          description: Indicates that the user does not have the required access to create a Timeline.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                    description: The error message.
                    example: update timeline error
                  statusCode:
                    type: number
                    example: 405
              examples:
                error:
                  summary: Error body
                  value:
                    body: update timeline error
                    statusCode: 405
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Timeline API
      summary: Create a Timeline or Timeline template
      description: Create a new Timeline or Timeline template.
      operationId: CreateTimelines
      requestBody:
        description: 'The required Timeline fields used to create a new Timeline, along with optional fields that will be created if not provided.'
        content:
          application/json:
            schema:
              required:
                - timeline
              type: object
              properties:
                status:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
                templateTimelineId:
                  type:
                    - 'null'
                    - string
                  description: A unique identifier for the Timeline template.
                  example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                templateTimelineVersion:
                  type:
                    - 'null'
                    - number
                  description: Timeline template version number.
                  example: 12
                timeline:
                  $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
                timelineId:
                  type:
                    - 'null'
                    - string
                  description: A unique identifier for the Timeline.
                  example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                timelineType:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
                version:
                  type:
                    - 'null'
                    - string
            examples:
              createDefault:
                summary: Create a default timeline
                value:
                  timeline:
                    status: active
                    timelineType: default
                    title: Malware containment
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
              examples:
                created:
                  summary: Created timeline
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: active
                    timelineType: default
                    title: Malware containment
                    version: WzE0LDFd
        '405':
          description: Indicates that there was an error in the Timeline creation.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                    description: The error message
                    example: update timeline error
                  statusCode:
                    type: number
                    example: 405
              examples:
                error:
                  summary: Error body
                  value:
                    body: update timeline error
                    statusCode: 405
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/_copy:
    post:
      tags:
        - Security Timeline API
      summary: Copies timeline or timeline template
      description: "Copies and returns a timeline or timeline template.\n"
      operationId: CopyTimeline
      requestBody:
        description: Source timeline id to copy plus timeline fields for the new saved object.
        content:
          application/json:
            schema:
              required:
                - timeline
                - timelineIdToCopy
              type: object
              properties:
                timeline:
                  $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
                timelineIdToCopy:
                  type: string
                  description: The `savedObjectId` of the timeline or template to duplicate.
            examples:
              copyWithTitle:
                summary: Copy with a new title
                value:
                  timeline:
                    timelineType: default
                    title: Copy of investigation
                  timelineIdToCopy: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
              examples:
                copied:
                  summary: Newly saved timeline
                  value:
                    savedObjectId: 6ce1b592-84e3-4b4a-9552-f189d4b82075
                    status: active
                    timelineType: default
                    title: Copy of investigation
                    version: WzE1LDFd
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/_draft:
    get:
      tags:
        - Security Timeline API
      summary: Get draft Timeline or Timeline template details
      description: 'Get the details of the draft Timeline  or Timeline template for the current user. If the user doesn''t have a draft Timeline, an empty Timeline is returned.'
      operationId: GetDraftTimelines
      parameters:
        - name: timelineType
          in: query
          description: Which draft to load (`default` investigation timeline or `template` timeline template).
          required: true
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
              examples:
                draftPayload:
                  summary: Draft timeline payload
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: draft
                    timelineType: default
                    title: ''
                    version: WzE0LDFd
        '403':
          description: 'If a draft Timeline was not found and we attempted to create one, it indicates that the user does not have the required permissions to create a draft Timeline.'
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
              examples:
                forbidden:
                  summary: Permission denied
                  value:
                    message: Forbidden
                    status_code: 403
        '409':
          description: 'This should never happen, but if a draft Timeline was not found and we attempted to create one, it indicates that there is already a draft Timeline with the given `timelineId`.'
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
              examples:
                conflict:
                  summary: Draft conflict
                  value:
                    message: Conflict
                    status_code: 409
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Security Timeline API
      summary: Create a clean draft Timeline or Timeline template
      description: "Create a clean draft Timeline or Timeline template for the current user.\n> info\n> If the user already has a draft Timeline, the existing draft Timeline is cleared and returned.\n"
      operationId: CleanDraftTimelines
      requestBody:
        description: The type of Timeline to create. Valid values are `default` and `template`.
        content:
          application/json:
            schema:
              required:
                - timelineType
              type: object
              properties:
                timelineType:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
            examples:
              defaultDraft:
                summary: Create a default draft timeline
                value:
                  timelineType: default
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
              examples:
                draftResponse:
                  summary: Draft after reset or creation
                  value:
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    status: draft
                    templateTimelineId: 'null'
                    templateTimelineVersion: 'null'
                    timelineType: default
                    title: ''
                    version: WzE0LDFd
        '403':
          description: Indicates that the user does not have the required permissions to create a draft Timeline.
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
              examples:
                forbidden:
                  summary: Permission denied
                  value:
                    message: Forbidden
                    status_code: 403
        '409':
          description: Indicates that there is already a draft Timeline with the given `timelineId`.
          content:
            application/json:
              schema:
                type: object
                properties:
                  message:
                    type: string
                  status_code:
                    type: number
              examples:
                conflict:
                  summary: Draft conflict
                  value:
                    message: Conflict
                    status_code: 409
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/_export:
    post:
      tags:
        - Security Timeline API
      summary: Export Timelines
      description: Export Timelines as an NDJSON file.
      operationId: ExportTimelines
      parameters:
        - name: file_name
          in: query
          description: The name of the file to export
          required: true
          schema:
            type: string
      requestBody:
        description: The IDs of the Timelines to export.
        content:
          application/json:
            schema:
              type: object
              properties:
                ids:
                  maxItems: 1000
                  minItems: 1
                  type:
                    - 'null'
                    - array
                  items:
                    type: string
            examples:
              exportIds:
                summary: Export by timeline ids
                value:
                  ids:
                    - 15c1929b-0af7-42bd-85a8-56e234cc7c4e
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/ndjson:
              schema:
                type: string
                description: NDJSON of the exported Timelines
              examples:
                ndjsonLine:
                  summary: Single NDJSON line
                  value: '{"savedObjectId":"15c1929b-0af7-42bd-85a8-56e234cc7c4e","version":"WzE0LDFd","title":"Investigation","timelineType":"default"}'
        '400':
          description: Bad Request response.
          content:
            application/ndjson:
              schema:
                type: object
                properties:
                  body:
                    type: string
                  statusCode:
                    type: number
              examples:
                badRequest:
                  summary: Export error
                  value:
                    body: Export limit exceeded
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/_favorite:
    patch:
      tags:
        - Security Timeline API
      summary: Favorite a Timeline or Timeline template
      description: Favorite a Timeline or Timeline template for the current user.
      operationId: PersistFavoriteRoute
      requestBody:
        description: The required fields used to favorite a (template) Timeline.
        content:
          application/json:
            schema:
              required:
                - timelineId
                - templateTimelineId
                - templateTimelineVersion
                - timelineType
              type: object
              properties:
                templateTimelineId:
                  type:
                    - 'null'
                    - string
                templateTimelineVersion:
                  type:
                    - 'null'
                    - number
                timelineId:
                  type:
                    - 'null'
                    - string
                timelineType:
                  $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
            examples:
              favoriteDefault:
                summary: Favorite a default timeline
                value:
                  templateTimelineId: 'null'
                  templateTimelineVersion: 'null'
                  timelineId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                  timelineType: default
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResponse'
              examples:
                favoriteResponse:
                  summary: Favorite metadata updated
                  value:
                    favorite:
                      - favoriteDate: 1741337636741
                        userName: elastic
                    savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                    timelineType: default
                    version: WzE2LDFd
        '403':
          description: Indicates the user does not have the required permissions to persist the favorite status.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                  statusCode:
                    type: number
              examples:
                forbidden:
                  summary: Forbidden
                  value:
                    body: Forbidden
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/_import:
    post:
      tags:
        - Security Timeline API
      summary: Import Timelines
      description: Import Timelines.
      operationId: ImportTimelines
      requestBody:
        description: The Timelines to import as a readable stream.
        content:
          application/json:
            schema:
              required:
                - file
              type: object
              properties:
                file: { }
                isImmutable:
                  enum:
                    - 'true'
                    - 'false'
                  type: string
                  description: Whether the Timeline should be immutable
            examples:
              multipartPlaceholder:
                summary: Request shape (file is a stream of NDJSON lines at runtime)
                value:
                  file: '{"savedObjectId":"15c1929b-0af7-42bd-85a8-56e234cc7c4e","version":"WzE0LDFd"}\n'
                  isImmutable: 'false'
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ImportTimelineResult'
              examples:
                importSummary:
                  summary: Import summary
                  value:
                    errors: [ ]
                    success: true
                    success_count: 5
                    timelines_installed: 3
                    timelines_updated: 2
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                    description: The error message
                    example: Invalid file extension
                  statusCode:
                    type: number
                    example: 400
              examples:
                badRequest:
                  summary: Invalid import
                  value:
                    body: Invalid file extension
                    statusCode: 400
        '404':
          description: Not found response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                    description: The error message
                    example: Unable to find saved object client
                  statusCode:
                    type: number
                    example: 404
              examples:
                notFound:
                  summary: Saved objects client missing
                  value:
                    body: Unable to find saved object client
                    statusCode: 404
        '409':
          description: Indicates the import of Timelines was unsuccessful.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                    description: The error message
                    example: Could not import timelines
                  statusCode:
                    type: number
                    example: 409
              examples:
                conflict:
                  summary: Import conflict
                  value:
                    body: Could not import timelines
                    statusCode: 409
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/_prepackaged:
    post:
      tags:
        - Security Timeline API
      summary: Install prepackaged Timelines
      description: Install or update prepackaged Timelines.
      operationId: InstallPrepackedTimelines
      requestBody:
        description: The Timelines to install or update.
        content:
          application/json:
            schema:
              required:
                - timelinesToInstall
                - timelinesToUpdate
                - prepackagedTimelines
              type: object
              properties:
                prepackagedTimelines:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject'
                timelinesToInstall:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_Timeline_API_ImportTimelines'
                timelinesToUpdate:
                  type: array
                  items:
                    $ref: '#/components/schemas/Security_Timeline_API_ImportTimelines'
            examples:
              emptyArrays:
                summary: Installer payload shape
                value:
                  prepackagedTimelines: [ ]
                  timelinesToInstall: [ ]
                  timelinesToUpdate: [ ]
        required: true
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ImportTimelineResult'
              examples:
                installResult:
                  summary: Install result counts
                  value:
                    errors: [ ]
                    success: true
                    success_count: 10
                    timelines_installed: 8
                    timelines_updated: 2
        '500':
          description: Indicates the installation of prepackaged Timelines was unsuccessful.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                  statusCode:
                    type: number
              examples:
                serverError:
                  summary: Server error
                  value:
                    body: Internal error
                    statusCode: 500
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timeline/resolve:
    get:
      tags:
        - Security Timeline API
      summary: Resolve a Timeline or Timeline template
      description: 'Resolve a Timeline or Timeline template, surfacing outcomes such as `exactMatch`, `aliasMatch`, or `conflict` when object IDs have been remapped during upgrades or imports. Provide **either** `id` for default Timelines or `template_timeline_id` for templates.'
      operationId: ResolveTimeline
      parameters:
        - name: template_timeline_id
          in: query
          description: The ID of the template timeline to resolve
          schema:
            type: string
        - name: id
          in: query
          description: The ID of the timeline to resolve
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Security_Timeline_API_ResolvedTimeline'
              examples:
                exactMatch:
                  summary: Exact match outcome
                  description: Timeline resolved without alias or conflict
                  value:
                    outcome: exactMatch
                    timeline:
                      savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                      timelineType: default
                      title: Investigation
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
              examples:
                badRequest:
                  summary: Bad request
                  value: { }
        '404':
          description: The (template) Timeline was not found
          content:
            application/json:
              schema:
                type: object
              examples:
                notFound:
                  summary: Not found
                  value: { }
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/timelines:
    get:
      tags:
        - Security Timeline API
      summary: Get Timelines or Timeline templates
      description: Get a list of all saved Timelines or Timeline templates.
      operationId: GetTimelines
      parameters:
        - name: only_user_favorite
          in: query
          description: 'If `true`, only Timelines that the current user has marked as favorite are returned.'
          schema:
            enum:
              - 'true'
              - 'false'
            type:
              - 'null'
              - string
        - name: timeline_type
          in: query
          description: Restrict results to `default` investigation timelines or `template` timeline templates.
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
        - name: sort_field
          in: query
          description: 'Field used to sort the list (`title`, `description`, `updated`, or `created`).'
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_SortFieldTimeline'
        - name: sort_order
          in: query
          description: Whether to sort the results `ascending` or `descending`
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: page_size
          in: query
          description: How many results should returned at once
          schema:
            type:
              - 'null'
              - string
        - name: page_index
          in: query
          description: How many pages should be skipped
          schema:
            type:
              - 'null'
              - string
        - name: search
          in: query
          description: Allows to search for timelines by their title
          schema:
            type:
              - 'null'
              - string
        - name: status
          in: query
          description: 'Filter by timeline lifecycle state (`active`, `draft`, or `immutable`).'
          schema:
            $ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              schema:
                required:
                  - timeline
                  - totalCount
                type: object
                properties:
                  customTemplateTimelineCount:
                    type: number
                    description: The amount of custom Timeline templates in the results
                    example: 2
                  defaultTimelineCount:
                    type: number
                    description: The amount of `default` type Timelines in the results
                    example: 90
                  elasticTemplateTimelineCount:
                    type: number
                    description: The amount of Elastic's Timeline templates in the results
                    example: 8
                  favoriteCount:
                    type: number
                    description: The amount of favorited Timelines
                    example: 5
                  templateTimelineCount:
                    type: number
                    description: The amount of Timeline templates in the results
                    example: 10
                  timeline:
                    type: array
                    items:
                      $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
                  totalCount:
                    type: number
                    description: The total amount of results
                    example: 100
              examples:
                timelineList:
                  summary: Example list response
                  value:
                    customTemplateTimelineCount: 0
                    defaultTimelineCount: 1
                    elasticTemplateTimelineCount: 0
                    favoriteCount: 0
                    templateTimelineCount: 0
                    timeline:
                      - savedObjectId: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
                        status: active
                        timelineType: default
                        title: Phishing investigation
                        updated: 1741344876825
                        version: WzE0LDFd
                    totalCount: 1
        '400':
          description: Bad Request response.
          content:
            application/json:
              schema:
                type: object
                properties:
                  body:
                    type: string
                    description: The error message.
                    example: get timeline error
                  statusCode:
                    type: number
                    example: 400
              examples:
                badRequest:
                  summary: Error response body
                  value:
                    body: get timeline error
                    statusCode: 400
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/upgrade_assistant/status:
    get:
      tags:
        - upgrade
      summary: Get the upgrade readiness status
      description: Check the status of your cluster.
      operationId: get-upgrade-status
      responses:
        '200':
          description: Indicates a successful call.
          content:
            application/json:
              examples:
                getUpgradeStatusResponseExample1:
                  value: "{\n  \"readyForUpgrade\": false,\n  \"cluster\": [\n    {\n      \"message\": \"Cluster deprecated issue\",\n      \"details\":\"You have 2 system indices that must be migrated and 5 Elasticsearch deprecation issues and 0 Kibana deprecation issues that must be resolved before upgrading.\"\n    }\n  ]\n}"
      x-state: Technical Preview
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/uptime/settings:
    get:
      tags:
        - uptime
      summary: Get uptime settings
      description: "You must have `read` privileges for the uptime feature in the Observability section of the Kibana feature privileges.\n"
      operationId: get-uptime-settings
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                type: object
              examples:
                getUptimeSettingsResponseExample1:
                  value: "{\n  \"heartbeatIndices\": \"heartbeat-8*\",\n  \"certExpirationThreshold\": 30,\n  \"certAgeThreshold\": 730,\n  \"defaultConnectors\": [\n      \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n      \"db25f830-2318-11ee-9391-6b0c030836d6\"\n  ],\n  \"defaultEmail\": {\n      \"to\": [],\n      \"cc\": [],\n      \"bcc\": []\n  }\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - uptime
      summary: Update uptime settings
      description: "Update uptime setting attributes like `heartbeatIndices`, `certExpirationThreshold`, `certAgeThreshold`, `defaultConnectors`, or `defaultEmail`. You must have `all` privileges for the uptime feature in the Observability section of the Kibana feature privileges. A partial update is supported, provided settings keys will be merged with existing settings.\n"
      operationId: put-uptime-settings
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                certAgeThreshold:
                  type: number
                  description: The number of days after a certificate is created to trigger an alert.
                  default: 730
                certExpirationThreshold:
                  type: number
                  description: The number of days before a certificate expires to trigger an alert.
                  default: 30
                defaultConnectors:
                  type: array
                  items:
                    type: string
                  description: A list of connector IDs to be used as default connectors for new alerts.
                  default: [ ]
                defaultEmail:
                  type: object
                  properties:
                    bcc:
                      type: array
                      items:
                        type: string
                      default: [ ]
                    cc:
                      type: array
                      items:
                        type: string
                      default: [ ]
                    to:
                      type: array
                      items:
                        type: string
                      default: [ ]
                  description: "The default email configuration for new alerts.\n"
                heartbeatIndices:
                  type: string
                  description: "An index pattern string to be used within the Uptime app and alerts to query Heartbeat data. \n"
                  default: heartbeat-*
            examples:
              putUptimeSettingsRequestExample1:
                summary: Update multiple settings
                description: Run `PUT api/uptime/settings` to update multiple Uptime settings.
                value: "{\n    \"heartbeatIndices\": \"heartbeat-8*\",\n    \"certExpirationThreshold\": 30,\n    \"certAgeThreshold\": 730,\n    \"defaultConnectors\": [\n        \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n        \"db25f830-2318-11ee-9391-6b0c030836d6\"\n    ],\n    \"defaultEmail\": {\n        \"to\": [],\n        \"cc\": [],\n        \"bcc\": []\n    }\n}"
              putUptimeSettingsRequestExample2:
                summary: Update a setting
                description: Run `PUT api/uptime/settings` to update a single Uptime setting.
                value: "{\n    \"heartbeatIndices\": \"heartbeat-8*\",\n}"
      responses:
        '200':
          description: Indicates a successful call
          content:
            application/json:
              schema:
                type: object
              examples:
                putUptimeSettingsResponseExample1:
                  description: A successful response from `PUT api/uptime/settings`.
                  value: "{\n    \"heartbeatIndices\": \"heartbeat-8*\",\n    \"certExpirationThreshold\": 30,\n    \"certAgeThreshold\": 730,\n    \"defaultConnectors\": [\n        \"08990f40-09c5-11ee-97ae-912b222b13d4\",\n        \"db25f830-2318-11ee-9391-6b0c030836d6\"\n    ],\n    \"defaultEmail\": {\n        \"to\": [],\n        \"cc\": [],\n        \"bcc\": []\n    }\n}"
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/visualizations:
    get:
      tags:
        - Visualizations
      summary: Search visualizations
      description: Returns a paginated list of Lens visualizations matching the optional `query` text.
      operationId: search-visualizations
      parameters:
        - name: fields
          in: query
          description: 'The saved object fields to include in each result. When omitted, all fields are returned.'
          schema:
            maxItems: 100
            type: array
            items:
              type: string
        - name: search_fields
          in: query
          description: The fields to match the `query` text against. Defaults to `title` when omitted.
          schema:
            maxItems: 100
            type: array
            items:
              type: string
        - name: query
          in: query
          description: Text to match against `search_fields`.
          schema:
            type: string
        - name: page
          in: query
          description: The page of results to return.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: per_page
          in: query
          description: The number of results to return per page.
          schema:
            maximum: 1000
            minimum: 1
            type: number
            default: 20
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                required:
                  - data
                  - meta
                type: object
                properties:
                  data:
                    maxItems: 1000
                    type: array
                    items:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_visResponseItem'
                  meta:
                    required:
                      - total
                    type: object
                    properties:
                      page:
                        minimum: 1
                        type: number
                        description: The returned page of results.
                        default: 1
                      per_page:
                        maximum: 1000
                        minimum: 1
                        type: number
                        description: The number of results returned per page.
                        default: 20
                      total:
                        type: number
                        description: The total number of results matching the query.
                    additionalProperties: false
                additionalProperties: false
              examples:
                searchVisualizationsResponse:
                  summary: Search visualizations response
                  description: "Paginated list of visualizations matching the query. Each item includes the ID, full chart configuration, and metadata. Use the GET endpoint to retrieve a single visualization by ID.\n"
                  value:
                    data:
                      - data:
                          data_source:
                            index_pattern: kibana_sample_data_logs
                            time_field: timestamp
                            type: data_view_spec
                          ignore_global_filters: false
                          metrics:
                            - empty_as_null: false
                              operation: count
                              type: primary
                          sampling: 1
                          styling:
                            primary:
                              labels:
                                alignment: left
                              position: bottom
                              value:
                                alignment: right
                                sizing: auto
                          tags: [ ]
                          title: Total requests
                          type: metric
                        id: 1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d
                        meta:
                          created_at: '2026-04-13T10:00:00.000Z'
                          managed: false
                          updated_at: '2026-04-13T10:00:00.000Z'
                          version: WzU5LDFd
                      - data:
                          axis:
                            x:
                              domain:
                                rounding: false
                                type: fit
                              grid:
                                visible: true
                              labels:
                                orientation: horizontal
                              ticks:
                                visible: true
                              title:
                                visible: true
                            y:
                              domain:
                                rounding: true
                                type: full
                              grid:
                                visible: true
                              labels:
                                orientation: horizontal
                              scale: linear
                              ticks:
                                visible: true
                              title:
                                visible: true
                          layers:
                            - data_source:
                                index_pattern: kibana_sample_data_logs
                                time_field: timestamp
                                type: data_view_spec
                              ignore_global_filters: false
                              sampling: 1
                              type: line
                              x:
                                drop_partial_intervals: false
                                field: timestamp
                                include_empty_rows: true
                                operation: date_histogram
                                suggested_interval: auto
                                use_original_time_range: false
                              y:
                                - axis: y
                                  empty_as_null: false
                                  operation: count
                          legend:
                            layout:
                              truncate:
                                max_lines: 1
                              type: grid
                            placement: outside
                            position: right
                            visibility: hidden
                          styling:
                            interpolation: linear
                            overlays:
                              current_time_marker:
                                visible: false
                              partial_buckets:
                                visible: false
                            points:
                              visibility: auto
                          tags: [ ]
                          title: Log entries over time
                          type: xy
                        id: 3a7c2e10-b3c5-11ef-bd7a-2b6b1a8c0f3d
                        meta:
                          created_at: '2026-04-13T10:05:00.000Z'
                          managed: false
                          updated_at: '2026-04-13T10:05:00.000Z'
                          version: WzYwLDFd
                    meta:
                      page: 1
                      per_page: 20
                      total: 2
        '400':
          description: Malformed request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-codeSamples:
        - label: Search visualizations - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/visualizations?query=requests&per_page=10\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Search visualizations - Console
          lang: Console
          source: "GET kbn:/api/visualizations?query=requests&per_page=10\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - Visualizations
      summary: Create visualization
      description: "Creates a Lens visualization and saves it to the library.\n\nES|QL visualizations cannot be created through this endpoint."
      operationId: create-visualization
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_metricLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_legacyMetricLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_xyLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_gaugeLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_heatmapLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_tagcloudLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_regionMapLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_datatableLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_pieLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_mosaicLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_treemapLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_waffleLibItemNoESQL'
      responses:
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visResponseItem'
              examples:
                createDataTableVisualizationResponse:
                  summary: Create a data table
                  description: "Response after creating a data table broken down by response code. Note that `rows` items gain a server-populated `rank_by` sort order.\n"
                  value:
                    data:
                      data_source:
                        index_pattern: kibana_sample_data_logs
                        time_field: timestamp
                        type: data_view_spec
                      ignore_global_filters: false
                      metrics:
                        - empty_as_null: false
                          operation: count
                      rows:
                        - fields:
                            - response.keyword
                          limit: 5
                          operation: terms
                          rank_by:
                            direction: desc
                            metric_index: 0
                            type: metric
                      sampling: 1
                      tags: [ ]
                      title: Top response codes
                      type: data_table
                    id: 83660652-bc77-46a1-8dca-5d512949eba6
                    meta:
                      created_at: '2026-04-13T10:15:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:15:00.000Z'
                      version: Wzc4LDFd
                createDataViewReferenceResponse:
                  summary: Create a visualization using a library data view
                  description: "Response after creating a metric chart that references an existing saved data view by ID (`ref_id`) instead of defining an inline index pattern.\n"
                  value:
                    data:
                      data_source:
                        ref_id: 90943e30-9a47-11e8-b64d-95841ca0b247
                        type: data_view_reference
                      ignore_global_filters: false
                      metrics:
                        - empty_as_null: false
                          operation: count
                          type: primary
                      sampling: 1
                      styling:
                        primary:
                          labels:
                            alignment: left
                          position: bottom
                          value:
                            alignment: right
                            sizing: auto
                      tags: [ ]
                      title: Total requests (library data view)
                      type: metric
                    id: cc44837a-7f20-42ee-b317-9af4f5eacc9c
                    meta:
                      created_at: '2026-04-13T10:20:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:20:00.000Z'
                      version: Wzc5LDFd
                createMetricVisualizationResponse:
                  summary: Create a metric visualization
                  description: "Response after creating a metric chart (count of requests) using an inline data view. Server-populated defaults are included in the response.\n"
                  value:
                    data:
                      data_source:
                        index_pattern: kibana_sample_data_logs
                        time_field: timestamp
                        type: data_view_spec
                      ignore_global_filters: false
                      metrics:
                        - empty_as_null: false
                          operation: count
                          type: primary
                      sampling: 1
                      styling:
                        primary:
                          labels:
                            alignment: left
                          position: bottom
                          value:
                            alignment: right
                            sizing: auto
                      tags: [ ]
                      title: Total requests
                      type: metric
                    id: 1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
                createPieVisualizationResponse:
                  summary: Create a pie/donut chart
                  description: "Response after creating a donut chart broken down by response code. Note that `group_by` items gain a server-populated `rank_by` sort order, and `legend`, `values`, and `labels` are populated with defaults.\n"
                  value:
                    data:
                      data_source:
                        index_pattern: kibana_sample_data_logs
                        time_field: timestamp
                        type: data_view_spec
                      group_by:
                        - fields:
                            - response.keyword
                          limit: 5
                          operation: terms
                          rank_by:
                            direction: desc
                            metric_index: 0
                            type: metric
                      ignore_global_filters: false
                      legend:
                        visibility: auto
                      metrics:
                        - empty_as_null: false
                          operation: count
                      sampling: 1
                      styling:
                        donut_hole: m
                        labels:
                          position: outside
                          visible: true
                        values:
                          mode: percentage
                          visible: true
                      tags: [ ]
                      title: Requests by response code
                      type: pie
                    id: 2cac466f-ff49-4d34-8d69-487a93a179c2
                    meta:
                      created_at: '2026-04-13T10:10:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:10:00.000Z'
                      version: Wzc3LDFd
                createXYVisualizationResponse:
                  summary: Create an XY line chart
                  description: "Response after creating an XY line chart. The response includes server-populated defaults for axis configuration, styling, and legend.\n"
                  value:
                    data:
                      axis:
                        x:
                          domain:
                            rounding: false
                            type: fit
                          grid:
                            visible: true
                          labels:
                            orientation: horizontal
                          ticks:
                            visible: true
                          title:
                            visible: true
                        y:
                          domain:
                            rounding: true
                            type: full
                          grid:
                            visible: true
                          labels:
                            orientation: horizontal
                          scale: linear
                          ticks:
                            visible: true
                          title:
                            visible: true
                      layers:
                        - data_source:
                            index_pattern: kibana_sample_data_logs
                            time_field: timestamp
                            type: data_view_spec
                          ignore_global_filters: false
                          sampling: 1
                          type: line
                          x:
                            drop_partial_intervals: false
                            field: timestamp
                            include_empty_rows: true
                            operation: date_histogram
                            suggested_interval: auto
                            use_original_time_range: false
                          y:
                            - axis: y
                              empty_as_null: false
                              operation: count
                      legend:
                        layout:
                          truncate:
                            max_lines: 1
                          type: grid
                        placement: outside
                        position: right
                        visibility: hidden
                      styling:
                        interpolation: linear
                        overlays:
                          current_time_marker:
                            visible: false
                          partial_buckets:
                            visible: false
                        points:
                          visibility: auto
                      tags: [ ]
                      title: Log entries over time
                      type: xy
                    id: 3a7c2e10-b3c5-11ef-bd7a-2b6b1a8c0f3d
                    meta:
                      created_at: '2026-04-13T10:05:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:05:00.000Z'
                      version: WzYwLDFd
        '400':
          description: Malformed request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-codeSamples:
        - label: Create a metric visualization - cURL
          lang: cURL_metric
          source: "curl -X POST \"${KIBANA_URL}/api/visualizations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"type\": \"metric\",\n  \"title\": \"Total requests\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"type\": \"primary\",\n      \"operation\": \"count\"\n    }\n  ]\n}'\n"
        - label: Create a metric visualization - Console
          lang: Console_metric
          source: "POST kbn:/api/visualizations\n{\n  \"type\": \"metric\",\n  \"title\": \"Total requests\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"type\": \"primary\",\n      \"operation\": \"count\"\n    }\n  ]\n}\n"
        - label: Create an XY line chart - cURL
          lang: cURL_xy
          source: "curl -X POST \"${KIBANA_URL}/api/visualizations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"type\": \"xy\",\n  \"title\": \"Log entries over time\",\n  \"layers\": [\n    {\n      \"type\": \"line\",\n      \"data_source\": {\n        \"type\": \"data_view_spec\",\n        \"index_pattern\": \"kibana_sample_data_logs\",\n        \"time_field\": \"timestamp\"\n      },\n      \"x\": {\n        \"operation\": \"date_histogram\",\n        \"field\": \"timestamp\"\n      },\n      \"y\": [\n        {\n          \"operation\": \"count\"\n        }\n      ]\n    }\n  ]\n}'\n"
        - label: Create an XY line chart - Console
          lang: Console_xy
          source: "POST kbn:/api/visualizations\n{\n  \"type\": \"xy\",\n  \"title\": \"Log entries over time\",\n  \"layers\": [\n    {\n      \"type\": \"line\",\n      \"data_source\": {\n        \"type\": \"data_view_spec\",\n        \"index_pattern\": \"kibana_sample_data_logs\",\n        \"time_field\": \"timestamp\"\n      },\n      \"x\": {\n        \"operation\": \"date_histogram\",\n        \"field\": \"timestamp\"\n      },\n      \"y\": [\n        {\n          \"operation\": \"count\"\n        }\n      ]\n    }\n  ]\n}\n"
        - label: Create a pie/donut chart - cURL
          lang: cURL_pie
          source: "curl -X POST \"${KIBANA_URL}/api/visualizations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"type\": \"pie\",\n  \"title\": \"Requests by response code\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"operation\": \"count\"\n    }\n  ],\n  \"group_by\": [\n    {\n      \"operation\": \"terms\",\n      \"fields\": [\n        \"response.keyword\"\n      ],\n      \"limit\": 5\n    }\n  ],\n  \"styling\": {\n    \"donut_hole\": \"m\"\n  }\n}'\n"
        - label: Create a pie/donut chart - Console
          lang: Console_pie
          source: "POST kbn:/api/visualizations\n{\n  \"type\": \"pie\",\n  \"title\": \"Requests by response code\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"operation\": \"count\"\n    }\n  ],\n  \"group_by\": [\n    {\n      \"operation\": \"terms\",\n      \"fields\": [\n        \"response.keyword\"\n      ],\n      \"limit\": 5\n    }\n  ],\n  \"styling\": {\n    \"donut_hole\": \"m\"\n  }\n}\n"
        - label: Create a data table - cURL
          lang: cURL_table
          source: "curl -X POST \"${KIBANA_URL}/api/visualizations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"type\": \"data_table\",\n  \"title\": \"Top response codes\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"operation\": \"count\"\n    }\n  ],\n  \"rows\": [\n    {\n      \"operation\": \"terms\",\n      \"fields\": [\n        \"response.keyword\"\n      ],\n      \"limit\": 5\n    }\n  ]\n}'\n"
        - label: Create a data table - Console
          lang: Console_table
          source: "POST kbn:/api/visualizations\n{\n  \"type\": \"data_table\",\n  \"title\": \"Top response codes\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"operation\": \"count\"\n    }\n  ],\n  \"rows\": [\n    {\n      \"operation\": \"terms\",\n      \"fields\": [\n        \"response.keyword\"\n      ],\n      \"limit\": 5\n    }\n  ]\n}\n"
        - label: Create a visualization using a library data view - cURL
          lang: cURL_library
          source: "curl -X POST \"${KIBANA_URL}/api/visualizations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"type\": \"metric\",\n  \"title\": \"Total requests (library data view)\",\n  \"data_source\": {\n    \"type\": \"data_view_reference\",\n    \"ref_id\": \"90943e30-9a47-11e8-b64d-95841ca0b247\"\n  },\n  \"metrics\": [\n    {\n      \"type\": \"primary\",\n      \"operation\": \"count\"\n    }\n  ]\n}'\n"
        - label: Create a visualization using a library data view - Console
          lang: Console_library
          source: "POST kbn:/api/visualizations\n{\n  \"type\": \"metric\",\n  \"title\": \"Total requests (library data view)\",\n  \"data_source\": {\n    \"type\": \"data_view_reference\",\n    \"ref_id\": \"90943e30-9a47-11e8-b64d-95841ca0b247\"\n  },\n  \"metrics\": [\n    {\n      \"type\": \"primary\",\n      \"operation\": \"count\"\n    }\n  ]\n}\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/visualizations/{id}':
    delete:
      tags:
        - Visualizations
      summary: Delete visualization
      description: 'Permanently deletes a Lens visualization. If the visualization is referenced by a dashboard panel, the panel shows an error after deletion.'
      operationId: delete-visualization
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The visualization identifier, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      responses:
        '204':
          description: No Content
        '400':
          description: Malformed request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Resource not found
        '500':
          description: Internal Server Error
      x-codeSamples:
        - label: Delete a visualization - cURL
          lang: cURL
          source: "curl -X DELETE \"${KIBANA_URL}/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - label: Delete a visualization - Console
          lang: Console
          source: "DELETE kbn:/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - Visualizations
      summary: Get visualization
      description: Returns a single Lens visualization by its ID.
      operationId: get-visualization
      parameters:
        - name: id
          in: path
          description: 'The visualization identifier, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visResponseItem'
              examples:
                getVisualizationResponse:
                  summary: Get visualization response
                  description: "The full visualization state including the chart configuration and metadata.\n"
                  value:
                    data:
                      data_source:
                        index_pattern: kibana_sample_data_logs
                        time_field: timestamp
                        type: data_view_spec
                      ignore_global_filters: false
                      metrics:
                        - empty_as_null: false
                          operation: count
                          type: primary
                      sampling: 1
                      styling:
                        primary:
                          labels:
                            alignment: left
                          position: bottom
                          value:
                            alignment: right
                            sizing: auto
                      tags: [ ]
                      title: Total requests
                      type: metric
                    id: 1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d
                    meta:
                      created_at: '2026-04-13T10:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T10:00:00.000Z'
                      version: WzU5LDFd
        '400':
          description: Malformed request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '404':
          description: Resource not found
        '500':
          description: Internal Server Error
      x-codeSamples:
        - label: Get a visualization - cURL
          lang: cURL
          source: "curl -X GET \"${KIBANA_URL}/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - label: Get a visualization - Console
          lang: Console
          source: "GET kbn:/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - Visualizations
      summary: Update visualization
      description: "Replaces the full configuration of an existing Lens visualization. Partial updates are not supported.\nTo make incremental changes, retrieve the visualization first, modify the fields you need, then send the complete object back.\n\nIf no visualization exists with the specified ID, a new one is created.\n\nES|QL visualizations cannot be updated through this endpoint."
      operationId: upsert-visualization
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: 'The visualization identifier, as returned by the create or search endpoints.'
          required: true
          schema:
            type: string
      requestBody:
        content:
          application/json:
            schema:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_metricLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_legacyMetricLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_xyLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_gaugeLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_heatmapLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_tagcloudLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_regionMapLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_datatableLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_pieLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_mosaicLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_treemapLibItemNoESQL'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_waffleLibItemNoESQL'
      responses:
        '200':
          description: Ok
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visResponseItem'
              examples:
                updateVisualizationResponse:
                  summary: Update visualization response
                  description: "The complete updated visualization state after a full replacement. PUT replaces the entire chart configuration - fields omitted from the request are reset to their defaults. `meta.created_at` reflects the update time rather than the original creation time.\n"
                  value:
                    data:
                      data_source:
                        index_pattern: kibana_sample_data_logs
                        time_field: timestamp
                        type: data_view_spec
                      ignore_global_filters: false
                      metrics:
                        - empty_as_null: false
                          operation: count
                          type: primary
                      sampling: 1
                      styling:
                        primary:
                          labels:
                            alignment: left
                          position: bottom
                          value:
                            alignment: right
                            sizing: auto
                      tags: [ ]
                      title: Total requests (updated)
                      type: metric
                    id: 1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d
                    meta:
                      created_at: '2026-04-13T11:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzYxLDFd
        '201':
          description: Created
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visResponseItem'
              examples:
                createdVisualizationResponse:
                  summary: Update visualization response
                  description: "The created visualization state. Server-populated defaults are included in the response.\n"
                  value:
                    data:
                      data_source:
                        index_pattern: kibana_sample_data_logs
                        time_field: timestamp
                        type: data_view_spec
                      ignore_global_filters: false
                      metrics:
                        - empty_as_null: false
                          operation: count
                          type: primary
                      sampling: 1
                      styling:
                        primary:
                          labels:
                            alignment: left
                          position: bottom
                          value:
                            alignment: right
                            sizing: auto
                      tags: [ ]
                      title: Total requests (updated)
                      type: metric
                    id: 1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d
                    meta:
                      created_at: '2026-04-13T11:00:00.000Z'
                      managed: false
                      updated_at: '2026-04-13T11:00:00.000Z'
                      version: WzYxLDFd
        '400':
          description: Malformed request
        '401':
          description: Unauthorized
        '403':
          description: Forbidden
        '500':
          description: Internal Server Error
      x-codeSamples:
        - label: Update a visualization - cURL
          lang: cURL
          source: "curl -X PUT \"${KIBANA_URL}/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n  \"type\": \"metric\",\n  \"title\": \"Total requests (updated)\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"type\": \"primary\",\n      \"operation\": \"count\"\n    }\n  ]\n}'\n"
        - label: Update a visualization - Console
          lang: Console
          source: "PUT kbn:/api/visualizations/1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\n{\n  \"type\": \"metric\",\n  \"title\": \"Total requests (updated)\",\n  \"data_source\": {\n    \"type\": \"data_view_spec\",\n    \"index_pattern\": \"kibana_sample_data_logs\",\n    \"time_field\": \"timestamp\"\n  },\n  \"metrics\": [\n    {\n      \"type\": \"primary\",\n      \"operation\": \"count\"\n    }\n  ]\n}\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows:
    delete:
      tags:
        - workflows
      summary: Bulk delete workflows
      description: 'Delete multiple workflows by their IDs.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:delete.'
      operationId: delete-workflows
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: force
          in: query
          description: 'When true, permanently deletes the workflows (hard delete) instead of soft-deleting them. The workflow IDs become available for reuse.'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ids
              type: object
              properties:
                ids:
                  maxItems: 1000
                  type: array
                  items:
                    type: string
                    description: Workflow ID to delete.
                  description: Array of workflow IDs to delete.
              additionalProperties: false
            examples:
              bulkDeleteWorkflowsRequestExample:
                description: Example request for deleting multiple workflows
                value:
                  ids:
                    - workflow-c3d4e5f6-a7b8-9012-cdef-234567890123
                    - workflow-d4e5f6a7-b8c9-0123-defa-345678901234
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                bulkDeleteWorkflowsResponseExample:
                  description: Example response after deleting multiple workflows
                  value:
                    deleted: 2
                    failures: [ ]
                    total: 2
      x-codeSamples:
        - label: Soft delete (default)
          lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/workflows\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"ids\": [\"workflow-c3d4e5f6-a7b8-9012-cdef-234567890123\", \"workflow-d4e5f6a7-b8c9-0123-defa-345678901234\"]\n  }'\n"
        - label: Hard delete (permanent)
          lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/workflows?force=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"ids\": [\"workflow-c3d4e5f6-a7b8-9012-cdef-234567890123\", \"workflow-d4e5f6a7-b8c9-0123-defa-345678901234\"]\n  }'\n"
        - lang: Console
          source: "DELETE kbn://api/workflows\n{\n  \"ids\": [\"workflow-c3d4e5f6-a7b8-9012-cdef-234567890123\", \"workflow-d4e5f6a7-b8c9-0123-defa-345678901234\"]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - workflows
      summary: Get workflows
      description: 'Retrieve a paginated list of workflows with optional filtering.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:read, workflowsManagement:readExecution, workflowsManagement:managed:readExecution.'
      operationId: get-workflows
      parameters:
        - name: query
          in: query
          description: Free-text search query.
          schema:
            type: string
        - name: size
          in: query
          description: Number of results per page.
          schema:
            minimum: 1
            type: number
        - name: page
          in: query
          description: Page number.
          schema:
            minimum: 1
            type: number
        - name: enabled
          in: query
          description: Filter by enabled state.
          schema:
            maxItems: 2
            type: array
            items:
              type: boolean
        - name: createdBy
          in: query
          description: Filter by creator.
          schema:
            maxItems: 1000
            type: array
            items:
              type: string
        - name: tags
          in: query
          description: Filter by tags.
          schema:
            maxItems: 1000
            type: array
            items:
              type: string
        - name: managed
          in: query
          description: Filter by managed status. Defaults to "unmanaged".
          schema:
            enum:
              - all
              - managed
              - unmanaged
            type: string
        - name: visibilityContext
          in: query
          description: 'When managed workflows are included, only return managed workflows visible in these contexts.'
          schema:
            maxItems: 1000
            type: array
            items:
              maxLength: 128
              type: string
        - name: sortField
          in: query
          description: Field to sort by.
          schema:
            enum:
              - name
              - enabled
            type: string
        - name: sortOrder
          in: query
          description: Sort direction.
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getWorkflowsResponseExample:
                  description: Example response returning a paginated list of workflows
                  value:
                    page: 1
                    results:
                      - createdAt: '2025-11-20T10:30:00.000Z'
                        definition:
                          description: This is a workflow example
                          enabled: true
                          inputs:
                            - default: hello world
                              name: message
                              type: string
                          name: Example definition
                          steps:
                            - name: hello_world_step
                              type: console
                              with:
                                message: '{{ inputs.message }}'
                          triggers:
                            - type: manual
                        description: This is a workflow example
                        enabled: true
                        history:
                          - duration: 5000
                            finishedAt: '2025-11-20T12:00:05.000Z'
                            id: exec-001
                            startedAt: '2025-11-20T12:00:00.000Z'
                            status: completed
                            workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                            workflowName: Example definition
                        id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        name: Example definition
                        tags:
                          - example
                        valid: true
                    size: 20
                    total: 1
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows?size=20&page=1&sortField=name&sortOrder=asc\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows?size=20&page=1&sortField=name&sortOrder=asc\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - workflows
      summary: Bulk create workflows
      description: 'Create multiple workflows in a single request. Optionally overwrite existing workflows.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:create AND workflowsManagement:update.'
      operationId: post-workflows
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: overwrite
          in: query
          description: Whether to overwrite existing workflows.
          schema:
            type: boolean
            default: false
        - name: dryRun
          in: query
          description: 'When true, performs a preflight conflict check only. Returns the subset of the supplied workflow IDs that already exist (including soft-deleted tombstones and cross-space documents) without writing anything. The response body is `{ existingIds: string[] }` instead of the normal `{ created, failed }` shape.'
          schema:
            type: boolean
            default: false
      requestBody:
        content:
          application/json:
            schema:
              required:
                - workflows
              type: object
              properties:
                workflows:
                  maxItems: 500
                  type: array
                  items:
                    required:
                      - yaml
                    type: object
                    properties:
                      id:
                        maxLength: 255
                        minLength: 3
                        pattern: '^[a-z0-9]([a-z0-9-]*[a-z0-9])?$'
                        type: string
                      yaml:
                        maxLength: 1048576
                        type: string
              additionalProperties: false
            examples:
              bulkCreateWorkflowsRequestExample:
                description: Example request for creating multiple workflows at once
                value:
                  workflows:
                    - yaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
                    - id: workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
                      yaml: "name: Second workflow\nenabled: false\ndescription: Another workflow\ntriggers:\n  - type: manual\nsteps:\n  - name: log_step\n    type: console\n    with:\n      message: \"Hello from second workflow\"\n"
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                bulkCreateWorkflowsResponseExample:
                  description: Example response after creating multiple workflows
                  value:
                    created:
                      - id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        name: Example definition
                      - id: workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
                        name: Second workflow
                    failures: [ ]
                    total: 2
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows?overwrite=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"workflows\": [\n      { \"yaml\": \"name: Example definition\\nenabled: true\\ndescription: This is a workflow example\\ntriggers:\\n  - type: manual\\ninputs:\\n  - name: message\\n    type: string\\n    default: \\\"hello world\\\"\\nsteps:\\n  - name: hello_world_step\\n    type: console\\n    with:\\n      message: \\\"{{ inputs.message }}\\\"\\n\" },\n      { \"id\": \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\", \"yaml\": \"name: Second workflow\\nenabled: false\\ndescription: Another workflow\\ntriggers:\\n  - type: manual\\nsteps:\\n  - name: log_step\\n    type: console\\n    with:\\n      message: \\\"Hello from second workflow\\\"\\n\" }\n    ]\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows?overwrite=false\n{\n  \"workflows\": [\n    { \"yaml\": \"name: Example definition\\nenabled: true\\ndescription: This is a workflow example\\ntriggers:\\n  - type: manual\\ninputs:\\n  - name: message\\n    type: string\\n    default: \\\"hello world\\\"\\nsteps:\\n  - name: hello_world_step\\n    type: console\\n    with:\\n      message: \\\"{{ inputs.message }}\\\"\\n\" },\n    { \"id\": \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\", \"yaml\": \"name: Second workflow\\nenabled: false\\ndescription: Another workflow\\ntriggers:\\n  - type: manual\\nsteps:\\n  - name: log_step\\n    type: console\\n    with:\\n      message: \\\"Hello from second workflow\\\"\\n\" }\n  ]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/aggs:
    get:
      tags:
        - workflows
      summary: Get workflow aggregations
      description: 'Retrieve distinct values and their counts for the specified workflow fields. Useful for building filters such as lists of tags or creators.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read.'
      operationId: get-workflows-aggs
      parameters:
        - name: fields
          in: query
          description: Field or fields to aggregate on.
          required: true
          schema:
            maxItems: 25
            minItems: 1
            type: array
            items:
              type: string
              description: Field name to aggregate.
            description: Fields to aggregate on.
        - name: managed
          in: query
          description: Filter aggregations by managed status.
          schema:
            enum:
              - all
              - managed
              - unmanaged
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getAggsResponseExample:
                  description: Example response with tag and createdBy aggregations
                  value:
                    createdBy:
                      - doc_count: 2
                        key: elastic
                    tags:
                      - doc_count: 1
                        key: reporting
                      - doc_count: 1
                        key: security
                      - doc_count: 1
                        key: triage
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/aggs?fields=tags&fields=createdBy\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/aggs?fields=tags&fields=createdBy\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/connectors:
    get:
      tags:
        - workflows
      summary: Get available connectors
      description: 'Retrieve the Kibana action connectors that can be used in workflow steps, grouped by connector type. Each type includes its configured instances and availability status.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read.'
      operationId: get-workflows-connectors
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getConnectorsResponseExample:
                  description: Example response with available connector types and their instances
                  value:
                    connectorTypes:
                      .email:
                        actionTypeId: .email
                        displayName: Email
                        enabled: true
                        enabledInConfig: true
                        enabledInLicense: true
                        instances: [ ]
                        minimumLicenseRequired: gold
                        subActions:
                          - displayName: Send
                            name: send
                      .slack_api:
                        actionTypeId: .slack_api
                        displayName: Slack
                        enabled: true
                        enabledInConfig: true
                        enabledInLicense: true
                        instances:
                          - id: slack-connector-1
                            isDeprecated: false
                            isPreconfigured: false
                            name: Team Notifications
                        minimumLicenseRequired: gold
                        subActions:
                          - displayName: Post Message
                            name: postMessage
                    totalConnectors: 1
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/connectors\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/connectors\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}':
    get:
      tags:
        - workflows
      summary: Get a workflow execution
      description: 'Retrieve details of a single workflow execution by its ID.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-executions-executionid
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 255
            type: string
        - name: includeInput
          in: query
          description: Include execution input data.
          schema:
            type: boolean
            default: false
        - name: includeOutput
          in: query
          description: Include execution output data.
          schema:
            type: boolean
            default: false
        - name: omitStepExecutions
          in: query
          description: 'When `true`, omit the embedded `stepExecutions` array. Defaults to `false`. When this is `false`, the embed is capped at 5000 steps.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getExecutionResponseExample:
                  description: Example response returning a workflow execution with step details
                  value:
                    duration: 3000
                    executedBy: elastic
                    finishedAt: '2025-11-20T12:00:03.000Z'
                    id: exec-a1b2c3d4-e5f6-7890
                    input:
                      message: hello world
                    isTestRun: false
                    output: hello world
                    spaceId: default
                    startedAt: '2025-11-20T12:00:00.000Z'
                    status: completed
                    stepExecutions:
                      - executionTimeMs: 1000
                        finishedAt: '2025-11-20T12:00:02.000Z'
                        globalExecutionIndex: 0
                        id: step-exec-001
                        isTestRun: false
                        scopeStack: [ ]
                        spaceId: default
                        startedAt: '2025-11-20T12:00:01.000Z'
                        status: completed
                        stepExecutionIndex: 0
                        stepId: hello_world_step
                        stepType: console
                        topologicalIndex: 0
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        workflowRunId: exec-a1b2c3d4-e5f6-7890
                    triggeredBy: manual
                    workflowDefinition:
                      description: This is a workflow example
                      enabled: true
                      inputs:
                        - default: hello world
                          name: message
                          type: string
                      name: Example definition
                      steps:
                        - name: hello_world_step
                          type: console
                          with:
                            message: '{{ inputs.message }}'
                      triggers:
                        - type: manual
                    workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    yaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}?includeInput=true&includeOutput=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}?includeInput=true&includeOutput=true\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/cancel':
    post:
      tags:
        - workflows
      summary: Cancel a workflow execution
      description: 'Cancel a running workflow execution by its ID.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:cancelExecution.'
      operationId: post-workflows-executions-executionid-cancel
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Indicates a successful response
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/executions/{executionId}/cancel\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "POST kbn://api/workflows/executions/{executionId}/cancel\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/children':
    get:
      tags:
        - workflows
      summary: Get child executions
      description: 'Retrieve child workflow executions spawned by sub-workflow steps within a parent execution.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-executions-executionid-children
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getChildrenExecutionsResponseExample:
                  description: Example response returning child workflow executions spawned by sub-workflow steps
                  value:
                    - executionId: child-exec-001
                      parentStepExecutionId: step-exec-003
                      status: completed
                      stepExecutions:
                        - executionTimeMs: 1000
                          finishedAt: '2025-11-20T12:00:07.000Z'
                          globalExecutionIndex: 0
                          id: child-step-001
                          isTestRun: false
                          scopeStack: [ ]
                          startedAt: '2025-11-20T12:00:06.000Z'
                          status: completed
                          stepExecutionIndex: 0
                          stepId: hello_world_step
                          stepType: console
                          topologicalIndex: 0
                          workflowId: workflow-e5f6a7b8-c9d0-1234-efab-456789012345
                          workflowRunId: child-exec-001
                      workflowId: workflow-e5f6a7b8-c9d0-1234-efab-456789012345
                      workflowName: Child Workflow
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}/children\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}/children\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/logs':
    get:
      tags:
        - workflows
      summary: Get execution logs
      description: 'Retrieve paginated logs for a workflow execution. Optionally filter by a specific step execution.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-executions-executionid-logs
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 255
            type: string
        - name: stepExecutionId
          in: query
          description: Filter logs by a specific step execution ID.
          schema:
            type: string
        - name: size
          in: query
          description: Number of log entries per page.
          schema:
            maximum: 100
            minimum: 1
            type: number
            default: 100
        - name: page
          in: query
          description: Page number.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: sortField
          in: query
          description: Field to sort by.
          schema:
            type: string
        - name: sortOrder
          in: query
          description: Sort order.
          schema:
            enum:
              - asc
              - desc
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getExecutionLogsResponseExample:
                  description: Example response returning paginated execution logs
                  value:
                    logs:
                      - additionalData:
                          executionId: exec-a1b2c3d4-e5f6-7890
                          workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        connectorType: console
                        duration: 150
                        id: log-001
                        level: info
                        message: Workflow execution started
                        stepId: hello_world_step
                        stepName: Hello World
                        timestamp: '2025-11-20T12:00:01.000Z'
                      - additionalData:
                          executionId: exec-a1b2c3d4-e5f6-7890
                          workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        connectorType: console
                        duration: 200
                        id: log-002
                        level: info
                        message: Step completed successfully
                        stepId: hello_world_step
                        stepName: Hello World
                        timestamp: '2025-11-20T12:00:02.000Z'
                    page: 1
                    size: 100
                    total: 2
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}/logs?size=100&page=1\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}/logs?size=100&page=1\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/resume':
    post:
      tags:
        - workflows
      summary: Resume a workflow execution
      description: 'Resume a paused workflow execution with the provided input.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:execute.'
      operationId: post-workflows-executions-executionid-resume
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - input
              type: object
              properties:
                input:
                  type: object
                  additionalProperties: { }
                  description: Input data to resume the execution with.
                stepExecutionId:
                  maxLength: 1024
                  minLength: 1
                  type: string
                  description: 'Step execution ID of the HITL wait to claim. When omitted, the server looks up the waiting step.'
              additionalProperties: false
            examples:
              resumeExecutionRequestExample:
                description: Example request to resume a paused workflow execution
                value:
                  input:
                    approved: true
                    comment: Approved by analyst
                  stepExecutionId: step-exec-a1b2c3d4
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                resumeExecutionResponseExample:
                  description: Example response confirming the resume was scheduled
                  value:
                    executionId: exec-a1b2c3d4-e5f6-7890
                    message: Workflow resume scheduled
                    success: true
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/executions/{executionId}/resume\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"input\": {\n      \"approved\": true,\n      \"comment\": \"Approved by analyst\"\n    },\n    \"stepExecutionId\": \"step-exec-a1b2c3d4\"\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/executions/{executionId}/resume\n{\n  \"input\": {\n    \"approved\": true,\n    \"comment\": \"Approved by analyst\"\n  },\n  \"stepExecutionId\": \"step-exec-a1b2c3d4\"\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/step/{stepExecutionId}':
    get:
      tags:
        - workflows
      summary: Get a step execution
      description: 'Retrieve details of a single step execution within a workflow execution.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-executions-executionid-step-stepexecutionid
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID.
          required: true
          schema:
            maxLength: 255
            type: string
        - name: stepExecutionId
          in: path
          description: Step execution ID.
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getStepExecutionResponseExample:
                  description: Example response returning a single step execution
                  value:
                    error: 'null'
                    executionTimeMs: 1000
                    finishedAt: '2025-11-20T12:00:02.000Z'
                    globalExecutionIndex: 0
                    id: step-exec-001
                    input:
                      message: hello world
                    isTestRun: false
                    output: hello world
                    scopeStack: [ ]
                    spaceId: default
                    startedAt: '2025-11-20T12:00:01.000Z'
                    state: 'null'
                    status: completed
                    stepExecutionIndex: 0
                    stepId: hello_world_step
                    stepType: console
                    topologicalIndex: 0
                    workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    workflowRunId: exec-a1b2c3d4-e5f6-7890
                getWaitForInputStepExecutionResponseExample:
                  description: 'Example response for a Human-In-The-Loop `wait_for_input` step. Once a responder submits via any client (Kibana Inbox UI, Slack, Agent Builder, raw API/MCP), the `hitl` envelope is populated synchronously — before Task Manager runs the resume — so every reader can detect the "responded but not yet resumed" state from this single doc.'
                  value:
                    error: 'null'
                    executionTimeMs: 329000
                    finishedAt: '2025-11-20T12:05:30.000Z'
                    globalExecutionIndex: 1
                    hitl:
                      channel: kibana-ui
                      respondedAt: '2025-11-20T12:05:29.000Z'
                      respondedBy: alice
                    id: step-exec-002
                    input:
                      message: Approve change to production?
                    isTestRun: false
                    output:
                      respondedBy: alice
                      response:
                        approved: true
                        reason: looks good
                    scopeStack: [ ]
                    spaceId: default
                    startedAt: '2025-11-20T12:00:01.000Z'
                    state: 'null'
                    status: completed
                    stepExecutionIndex: 0
                    stepId: approve_change
                    stepType: wait_for_input
                    topologicalIndex: 1
                    workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    workflowRunId: exec-a1b2c3d4-e5f6-7890
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}/step/{stepExecutionId}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}/step/{stepExecutionId}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/steps':
    get:
      tags:
        - workflows
      summary: Get execution step executions
      description: 'Retrieve a paginated list of step executions for a specific workflow execution. Does not include step input or output; fetch those with GET /api/workflows/executions/{executionId}/step/{stepExecutionId}. If a page exceeds Kibana''s response buffer, the handler still returns 200 with `results: []` and the page `total`.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-executions-executionid-steps
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 255
            type: string
        - name: page
          in: query
          description: Page number.
          schema:
            minimum: 1
            type: number
            default: 1
        - name: size
          in: query
          description: Number of step executions per page.
          schema:
            maximum: 5000
            minimum: 1
            type: number
            default: 1000
      responses:
        '200':
          description: 'Indicates a successful response. If the page exceeds Kibana''s response buffer, the handler still returns 200 with results: [] and the page total.'
          content:
            application/json:
              examples:
                getExecutionStepsResponseExample:
                  description: Example response returning a page of step executions for a workflow run
                  value:
                    page: 1
                    results:
                      - executionTimeMs: 1000
                        finishedAt: '2025-11-20T12:00:02.000Z'
                        globalExecutionIndex: 0
                        id: step-exec-001
                        isTestRun: false
                        scopeStack: [ ]
                        spaceId: default
                        startedAt: '2025-11-20T12:00:01.000Z'
                        status: completed
                        stepExecutionIndex: 0
                        stepId: hello_world_step
                        stepType: console
                        topologicalIndex: 0
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        workflowRunId: exec-a1b2c3d4-e5f6-7890
                    size: 1000
                    total: 1
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}/steps?page=1&size=1000\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}/steps?page=1&size=1000\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/steps/{stepId}/resume/external':
    get:
      tags:
        - workflows
      summary: Resume a workflow execution from an external link
      description: Resume a paused `waitForApproval` step (pauses the workflow and waits for a human to approve/decline before execution continues) or `waitForInput` step (passes the expected input values as query parameters in the URL). Returns an HTML confirmation page.
      operationId: get-workflows-executions-executionid-steps-stepid-resume-external
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 128
            type: string
        - name: stepId
          in: path
          description: Workflow step execution ID
          required: true
          schema:
            maxLength: 128
            type: string
        - name: token
          in: query
          description: The token created when the workflow execution was paused. Authenticates the request to resume execution.
          required: true
          schema:
            maxLength: 128
            type: string
        - name: approved
          in: query
          description: Indicates whether a human reviewer approved the paused step. Required for `waitForApproval` when resuming an approval step.
          schema:
            anyOf:
              - type: boolean
              - enum:
                  - 'true'
                type: string
              - enum:
                  - 'false'
                type: string
      responses:
        '200':
          description: An HTML confirmation page confirming that the response was received and the workflow execution was resumed.
          content:
            text/html:
              schema:
                type: string
              examples:
                externalResumeSuccessExample:
                  description: Success page confirming the response was received
                  value: <!DOCTYPE html><html><body><h1>Thank you</h1><p>Your response was received. You can close this window.</p></body></html>
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}/steps/{stepId}/resume/external?token=${RESUME_TOKEN}&approved=true\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}/steps/{stepId}/resume/external?token={resumeToken}&approved=true\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - workflows
      summary: Submit external input for a paused workflow execution
      description: 'Resume a workflow execution that is paused and waiting for external input. Submit input values as a JSON request body, authenticated with a token query parameter. Returns an HTML confirmation page.'
      operationId: post-workflows-executions-executionid-steps-stepid-resume-external
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 128
            type: string
        - name: stepId
          in: path
          description: Workflow step execution ID
          required: true
          schema:
            maxLength: 128
            type: string
        - name: token
          in: query
          description: The resume token authenticating this request.
          required: true
          schema:
            maxLength: 128
            type: string
      requestBody:
        content:
          application/json:
            schema: { }
            examples:
              externalResumeInputRequestExample:
                description: Example external input payload for a waitForInput step
                value:
                  description: Escalated from Slack triage
                  severity: high
      responses:
        '200':
          description: An HTML confirmation page confirming that the input was received and the workflow execution was resumed.
          content:
            text/html:
              schema:
                type: string
              examples:
                externalResumeInputSuccessExample:
                  description: Success page confirming the input was received
                  value: <!DOCTYPE html><html><body><h1>Thank you</h1><p>Your response was received. You can close this window.</p></body></html>
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/executions/{executionId}/steps/{stepId}/resume/external?token=${RESUME_TOKEN}\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\"severity\":\"high\"}'\n"
        - lang: Console
          source: "POST kbn://api/workflows/executions/{executionId}/steps/{stepId}/resume/external?token={resumeToken}\nContent-Type: application/json\n\n{\"severity\":\"high\"}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/executions/{executionId}/steps/{stepId}/resume/external/form':
    get:
      tags:
        - workflows
      summary: Get the external input form for a paused workflow execution
      description: Returns an HTML form for submitting external input to a paused waitForInput step. Does not resume the execution.
      operationId: get-workflows-executions-executionid-steps-stepid-resume-external-form
      parameters:
        - name: executionId
          in: path
          description: Workflow execution ID
          required: true
          schema:
            maxLength: 128
            type: string
        - name: stepId
          in: path
          description: Workflow step execution ID
          required: true
          schema:
            maxLength: 128
            type: string
        - name: token
          in: query
          description: The resume token authenticating this request.
          required: true
          schema:
            maxLength: 128
            type: string
      responses:
        '200':
          description: HTML form page for submitting external input to a paused waitForInput step
          content:
            text/html:
              schema:
                type: string
              examples:
                externalResumeFormExample:
                  description: Form page for external input submission
                  value: <!DOCTYPE html><html><body><h1>Submit your response</h1><form method="POST"><button type="submit">Submit</button></form></body></html>
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/executions/{executionId}/steps/{stepId}/resume/external/form?token=${RESUME_TOKEN}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/executions/{executionId}/steps/{stepId}/resume/external/form?token={resumeToken}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/export:
    post:
      tags:
        - workflows
      summary: Export workflows
      description: 'Export one or more workflows as JSON with YAML content and metadata.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read.'
      operationId: post-workflows-export
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ids
              type: object
              properties:
                ids:
                  maxItems: 500
                  minItems: 1
                  type: array
                  items:
                    maxLength: 255
                    type: string
                    description: Workflow ID to export.
                  description: Array of workflow IDs to export.
              additionalProperties: false
            examples:
              exportWorkflowsRequestExample:
                description: Example request to export workflows
                value:
                  ids:
                    - workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    - workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
      responses:
        '200':
          description: JSON containing exported workflow YAML entries and manifest metadata
          content:
            application/json:
              examples:
                exportWorkflowsResponseExample:
                  description: Workflow entries with YAML content and export manifest
                  value:
                    entries:
                      - id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        yaml: "name: My Workflow\nsteps:\n  - type: http.request\n    with:\n      url: https://example.com"
                      - id: workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
                        yaml: "name: Another Workflow\nsteps:\n  - type: http.request\n    with:\n      url: https://example.com"
                    manifest:
                      exportedAt: '2026-03-26T12:00:00.000Z'
                      exportedCount: 2
                      version: '1'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/export\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"ids\": [\"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\", \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\"]\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/export\n{\n  \"ids\": [\"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\", \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\"]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/managed/workflow/{id}':
    put:
      tags:
        - workflows
      summary: Update a managed workflow
      description: 'Partially update an existing managed workflow. This elevated route can update fields beyond the enabled state.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:update AND workflowsManagement:managed:update.'
      operationId: put-workflows-managed-workflow-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                enabled:
                  type: boolean
                name:
                  type: string
                tags:
                  type: array
                  items:
                    type: string
                yaml:
                  type: string
              additionalProperties: false
            examples:
              updateManagedWorkflowExample:
                description: Example request to update a managed workflow
                value:
                  description: Updated managed workflow description
                  enabled: true
                  name: Updated managed workflow
                  tags:
                    - managed
                    - updated
                  yaml: "name: Updated managed workflow\nenabled: true\ndescription: Updated managed workflow description\ntriggers:\n  - type: manual\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"hello world\"\n"
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateManagedWorkflowResponseExample:
                  description: Example response returning the updated managed workflow
                  value:
                    enabled: true
                    id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    lastUpdatedAt: '2026-03-23T13:38:59.568Z'
                    lastUpdatedBy: elastic
                    valid: true
                    validationErrors: [ ]
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/workflows/managed/workflow/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"name\": \"Updated managed workflow\",\n    \"enabled\": true,\n    \"tags\": [\"managed\", \"updated\"]\n  }'\n"
        - lang: Console
          source: "PUT kbn://api/workflows/managed/workflow/{id}\n{\n  \"name\": \"Updated managed workflow\",\n  \"enabled\": true,\n  \"tags\": [\"managed\", \"updated\"]\n}\n"
      x-state: Generally available; added in 9.5.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/mget:
    post:
      tags:
        - workflows
      summary: Get workflows by IDs
      description: 'Retrieve multiple workflows by their IDs in a single request. Optionally use the `source` parameter to return only specific fields from each workflow document.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read.'
      operationId: post-workflows-mget
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - ids
              type: object
              properties:
                ids:
                  maxItems: 500
                  minItems: 1
                  type: array
                  items:
                    maxLength: 255
                    type: string
                    description: Workflow ID.
                  description: Array of workflow IDs to look up.
                source:
                  maxItems: 10
                  minItems: 1
                  type: array
                  items:
                    maxLength: 255
                    type: string
                    description: Source field.
                  description: Array of source fields to include.
              additionalProperties: false
            examples:
              mgetWorkflowsRequestExample:
                description: Example request to retrieve multiple workflows by their IDs
                value:
                  ids:
                    - workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    - workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
                  source:
                    - name
                    - enabled
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                mgetWorkflowsResponseExample:
                  description: Example response returning the requested workflows with projected fields
                  value:
                    - enabled: true
                      id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                      name: Example definition
                    - enabled: false
                      id: workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
                      name: Second workflow
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/mget\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"ids\": [\"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\", \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\"],\n    \"source\": [\"name\", \"enabled\"]\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/mget\n{\n  \"ids\": [\"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\", \"workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901\"],\n  \"source\": [\"name\", \"enabled\"]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/schema:
    get:
      tags:
        - workflows
      summary: Get workflow JSON schema
      description: 'Retrieve the JSON schema used to validate workflow YAML definitions. The schema includes available step types based on the configured connectors in the current space.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read.'
      operationId: get-workflows-schema
      parameters:
        - name: loose
          in: query
          description: 'When true, returns a permissive schema that allows additional properties. When false, returns a strict schema for full validation.'
          required: true
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getSchemaResponseExample:
                  description: Example response returning the workflow JSON schema (truncated)
                  value:
                    $schema: http://json-schema.org/draft-07/schema#
                    type: object
                    properties:
                      description:
                        type: string
                      enabled:
                        default: true
                        type: boolean
                      name:
                        minLength: 1
                        type: string
                      tags:
                        items:
                          type: string
                        type: array
                      version:
                        const: '1'
                        default: '1'
                        description: The version of the workflow schema
                        type: string
                    required:
                      - name
                      - triggers
                      - steps
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/schema?loose=false\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/schema?loose=false\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/stats:
    get:
      tags:
        - workflows
      summary: Get workflow statistics
      description: 'Retrieve summary statistics about workflows, including total, enabled, and disabled counts; execution history metrics for the last 30 days are included only when the caller has execution read privilege.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:read, workflowsManagement:readExecution, workflowsManagement:managed:readExecution.'
      operationId: get-workflows-stats
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getStatsResponseExample:
                  description: Example response with workflow counts and 30-day execution history
                  value:
                    executions:
                      - cancelled: 1
                        completed: 45
                        date: '2025-11-20'
                        failed: 2
                        timestamp: '2025-11-20T00:00:00.000Z'
                      - cancelled: 0
                        completed: 50
                        date: '2025-11-21'
                        failed: 0
                        timestamp: '2025-11-21T00:00:00.000Z'
                    workflows:
                      disabled: 3
                      enabled: 12
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/stats\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/stats\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/step/test:
    post:
      tags:
        - workflows
      summary: Test a workflow step
      description: 'Execute a single step from a workflow definition in test mode.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:execute.'
      operationId: post-workflows-step-test
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - stepId
                - contextOverride
                - workflowYaml
              type: object
              properties:
                contextOverride:
                  type: object
                  additionalProperties: { }
                  description: Context overrides for the step execution.
                executionContext:
                  type: object
                  additionalProperties: { }
                  description: Execution context for the step execution.
                stepId:
                  type: string
                  description: ID of the step to test.
                workflowId:
                  type: string
                  description: ID of the workflow containing the step.
                workflowYaml:
                  type: string
                  description: YAML definition of the workflow containing the step.
              additionalProperties: false
            examples:
              testStepRequestExample:
                description: Example request to test a single workflow step
                value:
                  contextOverride:
                    inputs:
                      message: override message
                  stepId: hello_world_step
                  workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                  workflowYaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                testStepResponseExample:
                  description: Example response returning the step test execution ID
                  value:
                    workflowExecutionId: step-test-exec-a1b2c3d4
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/step/test\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"stepId\": \"hello_world_step\",\n    \"workflowId\": \"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n    \"workflowYaml\": \"name: Example definition\\nenabled: true\\ntriggers:\\n  - type: manual\\ninputs:\\n  - name: message\\n    type: string\\n    default: \\\"hello world\\\"\\nsteps:\\n  - name: hello_world_step\\n    type: console\\n    with:\\n      message: \\\"{{ inputs.message }}\\\"\",\n    \"contextOverride\": { \"inputs\": { \"message\": \"override message\" } }\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/step/test\n{\n  \"stepId\": \"hello_world_step\",\n  \"workflowId\": \"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n  \"workflowYaml\": \"name: Example definition\\nenabled: true\\ntriggers:\\n  - type: manual\\ninputs:\\n  - name: message\\n    type: string\\n    default: \\\"hello world\\\"\\nsteps:\\n  - name: hello_world_step\\n    type: console\\n    with:\\n      message: \\\"{{ inputs.message }}\\\"\",\n  \"contextOverride\": { \"inputs\": { \"message\": \"override message\" } }\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/test:
    post:
      tags:
        - workflows
      summary: Test a workflow
      description: 'Execute a workflow in test mode without requiring it to be saved or enabled. Provide either a workflow ID to test a saved workflow, a YAML definition to test an unsaved draft, or both to test a modified version of an existing workflow.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:execute.'
      operationId: post-workflows-test
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - inputs
              type: object
              properties:
                inputs:
                  type: object
                  additionalProperties: { }
                  description: Key-value inputs for the test execution.
                workflowId:
                  type: string
                  description: ID of an existing workflow to test.
                workflowYaml:
                  type: string
                  description: YAML definition to test.
              additionalProperties: false
            examples:
              testWorkflowByIdRequestExample:
                description: Example request to test a saved workflow by its ID
                value:
                  inputs:
                    message: test message
                  workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
              testWorkflowByYamlRequestExample:
                description: Example request to test an unsaved workflow YAML draft
                value:
                  inputs:
                    message: test message
                  workflowYaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                testWorkflowResponseExample:
                  description: Example response returning the test execution ID
                  value:
                    workflowExecutionId: test-exec-a1b2c3d4-e5f6
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/test\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"workflowId\": \"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n    \"inputs\": { \"message\": \"test message\" }\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/test\n{\n  \"workflowId\": \"workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890\",\n  \"inputs\": { \"message\": \"test message\" }\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/workflow:
    post:
      tags:
        - workflows
      summary: Create a workflow
      description: 'Create a new workflow from a YAML definition. The YAML is validated and parsed before the workflow is saved. An optional custom ID can be provided.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:create.'
      operationId: post-workflows-workflow
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
      requestBody:
        content:
          application/json:
            schema:
              required:
                - yaml
              type: object
              properties:
                id:
                  maxLength: 255
                  minLength: 3
                  pattern: '^[a-z0-9]([a-z0-9-]*[a-z0-9])?$'
                  type: string
                yaml:
                  maxLength: 1048576
                  type: string
              additionalProperties: false
            examples:
              createWorkflowRequestExample:
                description: Example request for creating a workflow from a YAML definition
                value:
                  yaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
              createWorkflowWithIdRequestExample:
                description: Example request for creating a workflow with a custom ID
                value:
                  id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                  yaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                createWorkflowResponseExample:
                  description: Example response returning the created workflow
                  value:
                    createdAt: '2025-11-20T10:30:00.000Z'
                    createdBy: elastic
                    definition:
                      description: This is a workflow example
                      enabled: true
                      inputs:
                        - default: hello world
                          name: message
                          type: string
                      name: Example definition
                      steps:
                        - name: hello_world_step
                          type: console
                          with:
                            message: '{{ inputs.message }}'
                      triggers:
                        - type: manual
                    description: This is a workflow example
                    enabled: true
                    id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    lastUpdatedAt: '2025-11-20T10:30:00.000Z'
                    lastUpdatedBy: elastic
                    name: Example definition
                    valid: true
                    yaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/workflow\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"yaml\": \"name: Example definition\\nenabled: true\\ndescription: This is a workflow example\\ntriggers:\\n  - type: manual\\ninputs:\\n  - name: message\\n    type: string\\n    default: \\\"hello world\\\"\\nsteps:\\n  - name: hello_world_step\\n    type: console\\n    with:\\n      message: \\\"{{ inputs.message }}\\\"\\n\"\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/workflow\n{\n  \"yaml\": \"name: Example definition\\nenabled: true\\ndescription: This is a workflow example\\ntriggers:\\n  - type: manual\\ninputs:\\n  - name: message\\n    type: string\\n    default: \\\"hello world\\\"\\nsteps:\\n  - name: hello_world_step\\n    type: console\\n    with:\\n      message: \\\"{{ inputs.message }}\\\"\\n\"\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/workflow/{id}':
    delete:
      tags:
        - workflows
      summary: Delete a workflow
      description: 'Delete a single workflow by its ID.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:delete.'
      operationId: delete-workflows-workflow-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
        - name: force
          in: query
          description: 'When true, permanently deletes the workflow (hard delete) instead of soft-deleting it. The workflow ID becomes available for reuse.'
          schema:
            type: boolean
            default: false
      responses:
        '200':
          description: Indicates a successful response
      x-codeSamples:
        - label: Soft delete (default)
          lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/workflows/workflow/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - label: Hard delete (permanent)
          lang: curl
          source: "curl \\\n  -X DELETE \"${KIBANA_URL}/api/workflows/workflow/{id}?force=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "DELETE kbn://api/workflows/workflow/{id}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - workflows
      summary: Get a workflow
      description: 'Retrieve a single workflow by its ID.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read OR workflowsManagement:managed:read.'
      operationId: get-workflows-workflow-id
      parameters:
        - name: id
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getWorkflowResponseExample:
                  description: Example response returning a single workflow
                  value:
                    createdAt: '2025-11-20T10:30:00.000Z'
                    createdBy: elastic
                    definition:
                      description: This is a workflow example
                      enabled: true
                      inputs:
                        - default: hello world
                          name: message
                          type: string
                      name: Example definition
                      steps:
                        - name: hello_world_step
                          type: console
                          with:
                            message: '{{ inputs.message }}'
                      triggers:
                        - type: manual
                    description: This is a workflow example
                    enabled: true
                    id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    lastUpdatedAt: '2025-11-21T14:00:00.000Z'
                    lastUpdatedBy: elastic
                    name: Example definition
                    valid: true
                    yaml: "name: Example definition\nenabled: true\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/workflow/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/workflow/{id}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - workflows
      summary: Update a workflow
      description: 'Partially update an existing workflow. You can update individual fields such as name, description, enabled state, tags, or the YAML definition without providing all fields.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:update.'
      operationId: put-workflows-workflow-id
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              type: object
              properties:
                description:
                  type: string
                enabled:
                  type: boolean
                name:
                  type: string
                tags:
                  type: array
                  items:
                    type: string
                yaml:
                  type: string
              additionalProperties: false
            examples:
              updateWorkflowEnableExample:
                description: Example request to enable a workflow and update its tags
                value:
                  enabled: true
                  tags:
                    - production
              updateWorkflowFullExample:
                description: Example request to update multiple workflow fields
                value:
                  description: Updated workflow description
                  enabled: true
                  name: Updated example
                  tags:
                    - example
                    - updated
                  yaml: "name: Updated example\nenabled: true\ndescription: Updated workflow description\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                updateWorkflowResponseExample:
                  description: Example response returning the updated workflow
                  value:
                    enabled: false
                    id: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    lastUpdatedAt: '2026-03-23T13:38:59.568Z'
                    lastUpdatedBy: elastic
                    valid: true
                    validationErrors: [ ]
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X PUT \"${KIBANA_URL}/api/workflows/workflow/{id}\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"enabled\": true,\n    \"tags\": [\"production\"]\n  }'\n"
        - lang: Console
          source: "PUT kbn://api/workflows/workflow/{id}\n{\n  \"enabled\": true,\n  \"tags\": [\"production\"]\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/workflow/{id}/clone':
    post:
      tags:
        - workflows
      summary: Clone a workflow
      description: 'Create a copy of an existing workflow.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:create AND workflowsManagement:read.'
      operationId: post-workflows-workflow-id-clone
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                cloneWorkflowResponseExample:
                  description: Example response returning the cloned workflow with a new ID
                  value:
                    createdAt: '2025-11-22T11:00:00.000Z'
                    createdBy: elastic
                    definition:
                      description: This is a workflow example
                      enabled: false
                      inputs:
                        - default: hello world
                          name: message
                          type: string
                      name: Example definition (copy)
                      steps:
                        - name: hello_world_step
                          type: console
                          with:
                            message: '{{ inputs.message }}'
                      triggers:
                        - type: manual
                    description: This is a workflow example
                    enabled: false
                    id: workflow-b2c3d4e5-f6a7-8901-bcde-f12345678901
                    lastUpdatedAt: '2025-11-22T11:00:00.000Z'
                    lastUpdatedBy: elastic
                    name: Example definition (copy)
                    valid: true
                    yaml: "name: Example definition (copy)\nenabled: false\ndescription: This is a workflow example\ntriggers:\n  - type: manual\ninputs:\n  - name: message\n    type: string\n    default: \"hello world\"\nsteps:\n  - name: hello_world_step\n    type: console\n    with:\n      message: \"{{ inputs.message }}\"\n"
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/workflow/{id}/clone\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "POST kbn://api/workflows/workflow/{id}/clone\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/workflow/{id}/run':
    post:
      tags:
        - workflows
      summary: Run a workflow
      description: 'Execute a workflow by its ID with the provided inputs. The workflow must be enabled and have a valid definition. Returns an execution ID that can be used to monitor progress.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:execute.'
      operationId: post-workflows-workflow-id-run
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: id
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
      requestBody:
        content:
          application/json:
            schema:
              required:
                - inputs
              type: object
              properties:
                inputs:
                  type: object
                  additionalProperties: { }
                  description: Key-value inputs for the workflow execution.
                metadata:
                  type: object
                  additionalProperties: { }
                  description: Optional metadata for the execution.
              additionalProperties: false
            examples:
              runWorkflowRequestExample:
                description: Example request to execute a workflow with inputs
                value:
                  inputs:
                    message: hello from the API
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                runWorkflowResponseExample:
                  description: Example response returning the execution ID
                  value:
                    workflowExecutionId: exec-a1b2c3d4-e5f6-7890
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/workflow/{id}/run\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"inputs\": {\n      \"message\": \"hello from the API\"\n    }\n  }'\n"
        - lang: Console
          source: "POST kbn://api/workflows/workflow/{id}/run\n{\n  \"inputs\": {\n    \"message\": \"hello from the API\"\n  }\n}\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/workflow/{workflowId}/executions':
    get:
      tags:
        - workflows
      summary: Get workflow executions
      description: 'Retrieve a paginated list of executions for a specific workflow.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-workflow-workflowid-executions
      parameters:
        - name: workflowId
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
        - name: statuses
          in: query
          description: Filter by execution status.
          schema:
            maxItems: 11
            type: array
            items:
              enum:
                - pending
                - waiting
                - waiting_for_input
                - waiting_for_child
                - running
                - queued
                - completed
                - failed
                - cancelled
                - timed_out
                - skipped
              type: string
        - name: executionTypes
          in: query
          description: Filter by execution type.
          schema:
            maxItems: 2
            type: array
            items:
              enum:
                - test
                - production
              type: string
        - name: executedBy
          in: query
          description: Filter by the user who triggered the execution.
          schema:
            maxItems: 100
            type: array
            items:
              type: string
        - name: concurrencyGroupKey
          in: query
          description: Filter by evaluated concurrency group key.
          schema:
            type: string
            x-state: Generally available; added in 9.5.0
        - name: omitStepRuns
          in: query
          description: Whether to exclude step-level execution data.
          schema:
            type: boolean
        - name: finishedAfter
          in: query
          description: Datemath lower bound for filtering executions by finishedAt (inclusive when parsed).
          schema:
            type: string
            x-state: Generally available; added in 9.5.0
        - name: finishedBefore
          in: query
          description: Datemath upper bound for filtering executions by finishedAt (inclusive when parsed with roundUp).
          schema:
            type: string
            x-state: Generally available; added in 9.5.0
        - name: collapse
          in: query
          description: Field to collapse execution results by.
          schema:
            enum:
              - concurrencyGroupKey
              - status
              - executedBy
              - triggeredBy
            type: string
            x-state: Generally available; added in 9.5.0
        - name: sortField
          in: query
          description: Field to sort executions by.
          schema:
            enum:
              - createdAt
              - finishedAt
            type: string
            x-state: Generally available; added in 9.5.0
        - name: sortOrder
          in: query
          description: Sort order.
          schema:
            enum:
              - asc
              - desc
            type: string
            x-state: Generally available; added in 9.5.0
        - name: page
          in: query
          description: Page number.
          schema:
            minimum: 1
            type: number
        - name: size
          in: query
          description: Number of results per page.
          schema:
            maximum: 100
            minimum: 1
            type: number
        - name: searchAfter
          in: query
          description: JSON-encoded search_after sort values from a prior response for cursor pagination.
          schema:
            maxLength: 4096
            type: string
            x-state: Generally available; added in 9.5.0
        - name: startedAfter
          in: query
          description: Datemath lower bound for filtering executions by startedAt (inclusive when parsed).
          schema:
            type: string
            x-state: Generally available; added in 9.5.0
        - name: startedBefore
          in: query
          description: Datemath upper bound for filtering executions by startedAt (inclusive when parsed with roundUp).
          schema:
            type: string
            x-state: Generally available; added in 9.5.0
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getWorkflowExecutionsResponseExample:
                  description: Example response returning a paginated list of executions for a workflow
                  value:
                    page: 1
                    results:
                      - duration: 3000
                        error: 'null'
                        executedBy: elastic
                        finishedAt: '2025-11-20T12:00:03.000Z'
                        id: exec-001
                        isTestRun: false
                        spaceId: default
                        startedAt: '2025-11-20T12:00:00.000Z'
                        status: completed
                        triggeredBy: manual
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                      - duration: 2000
                        error:
                          message: Step 'hello_world_step' failed
                        executedBy: elastic
                        finishedAt: '2025-11-20T13:00:02.000Z'
                        id: exec-002
                        isTestRun: false
                        spaceId: default
                        startedAt: '2025-11-20T13:00:00.000Z'
                        status: failed
                        triggeredBy: manual
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                    size: 20
                    total: 2
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/workflow/{workflowId}/executions?page=1&size=20\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/workflow/{workflowId}/executions?page=1&size=20&startedAfter=now-1d&startedBefore=now\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/workflow/{workflowId}/executions/cancel':
    post:
      tags:
        - workflows
      summary: Cancel all active workflow executions
      description: 'Request cancellation for all non-terminal executions of the given workflow in the current space.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:cancelExecution.'
      operationId: post-workflows-workflow-workflowid-executions-cancel
      parameters:
        - name: kbn-xsrf
          in: header
          description: A required header to protect against CSRF attacks
          required: true
          schema:
            type: string
            example: 'true'
        - name: workflowId
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
      responses:
        '200':
          description: Indicates a successful response
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X POST \"${KIBANA_URL}/api/workflows/workflow/{workflowId}/executions/cancel\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\"\n"
        - lang: Console
          source: "POST kbn://api/workflows/workflow/{workflowId}/executions/cancel\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/api/workflows/workflow/{workflowId}/executions/steps':
    get:
      tags:
        - workflows
      summary: Get workflow step executions
      description: 'Retrieve a paginated list of step-level execution records for a specific workflow. Optionally filter by step ID and include input or output data.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-workflow-workflowid-executions-steps
      parameters:
        - name: workflowId
          in: path
          description: Workflow ID
          required: true
          schema:
            maxLength: 255
            type: string
        - name: stepId
          in: query
          description: Filter by step ID.
          schema:
            type: string
        - name: includeInput
          in: query
          description: Include step input data.
          schema:
            type: boolean
        - name: includeOutput
          in: query
          description: Include step output data.
          schema:
            type: boolean
        - name: page
          in: query
          description: Page number for pagination.
          schema:
            minimum: 1
            type: number
        - name: size
          in: query
          description: Number of results per page.
          schema:
            maximum: 100
            minimum: 1
            type: number
        - name: startedAfter
          in: query
          description: Datemath lower bound for filtering step executions by startedAt (inclusive when parsed).
          schema:
            type: string
        - name: startedBefore
          in: query
          description: Datemath upper bound for filtering step executions by startedAt (inclusive when parsed with roundUp).
          schema:
            type: string
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                getWorkflowStepExecutionsResponseExample:
                  description: 'Example response returning step execution records for a workflow. The second entry shows a Human-In-The-Loop `wait_for_input` step that has been responded to: the `hitl` envelope is populated synchronously by the inbox respond path so every reader (Kibana Inbox UI, Slack, Agent Builder, raw API/MCP) sees a single canonical responder for the step.'
                  value:
                    results:
                      - executionTimeMs: 1000
                        finishedAt: '2025-11-20T12:00:02.000Z'
                        globalExecutionIndex: 0
                        id: step-exec-001
                        input:
                          message: hello world
                        isTestRun: false
                        scopeStack: [ ]
                        spaceId: default
                        startedAt: '2025-11-20T12:00:01.000Z'
                        status: completed
                        stepExecutionIndex: 0
                        stepId: hello_world_step
                        stepType: console
                        topologicalIndex: 0
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        workflowRunId: exec-001
                      - executionTimeMs: 329000
                        finishedAt: '2025-11-20T12:05:31.000Z'
                        globalExecutionIndex: 1
                        hitl:
                          channel: kibana-ui
                          respondedAt: '2025-11-20T12:05:29.000Z'
                          respondedBy: alice
                        id: step-exec-002
                        input:
                          message: Approve change to production?
                        isTestRun: false
                        output:
                          respondedBy: alice
                          response:
                            approved: true
                        scopeStack: [ ]
                        spaceId: default
                        startedAt: '2025-11-20T12:00:02.000Z'
                        status: completed
                        stepExecutionIndex: 0
                        stepId: approve_change
                        stepType: wait_for_input
                        topologicalIndex: 1
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        workflowRunId: exec-001
                    total: 2
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/workflow/{workflowId}/executions/steps?includeInput=true\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/workflow/{workflowId}/executions/steps?includeInput=true\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  /api/workflows/workflow/executions:
    get:
      tags:
        - workflows
      summary: Search workflow executions
      description: 'Search across all workflow executions.<br/><br/>[Required authorization] Route required privileges: workflowsManagement:read AND workflowsManagement:readExecution. Extended privileges (optional, expand functionality when granted): workflowsManagement:managed:readExecution.'
      operationId: get-workflows-workflow-executions
      parameters:
        - name: kql
          in: query
          description: KQL query string to filter executions.
          schema:
            maxLength: 4096
            type: string
        - name: statuses
          in: query
          description: Filter by execution status.
          schema:
            maxItems: 11
            type: array
            items:
              enum:
                - pending
                - waiting
                - waiting_for_input
                - waiting_for_child
                - running
                - queued
                - completed
                - failed
                - cancelled
                - timed_out
                - skipped
              type: string
        - name: executionTypes
          in: query
          description: Filter by execution type.
          schema:
            maxItems: 2
            type: array
            items:
              enum:
                - test
                - production
              type: string
        - name: executedBy
          in: query
          description: Filter by the user who triggered the execution.
          schema:
            maxItems: 100
            type: array
            items:
              type: string
        - name: concurrencyGroupKey
          in: query
          description: Filter by evaluated concurrency group key.
          schema:
            type: string
        - name: startedAfter
          in: query
          description: Datemath lower bound for filtering executions by startedAt.
          schema:
            type: string
        - name: startedBefore
          in: query
          description: Datemath upper bound for filtering executions by startedAt.
          schema:
            type: string
        - name: finishedAfter
          in: query
          description: Datemath lower bound for filtering executions by finishedAt.
          schema:
            type: string
        - name: finishedBefore
          in: query
          description: Datemath upper bound for filtering executions by finishedAt.
          schema:
            type: string
        - name: collapse
          in: query
          description: Field to collapse execution results by.
          schema:
            enum:
              - concurrencyGroupKey
              - status
              - executedBy
              - triggeredBy
            type: string
        - name: sortField
          in: query
          description: 'Field to sort by. One of: startedAt, duration, workflowId, triggeredBy.'
          schema:
            enum:
              - startedAt
              - duration
              - workflowId
              - triggeredBy
            type: string
        - name: sortOrder
          in: query
          description: Sort direction.
          schema:
            enum:
              - asc
              - desc
            type: string
        - name: page
          in: query
          description: Page number.
          schema:
            minimum: 1
            type: number
        - name: size
          in: query
          description: Number of results to return.
          schema:
            maximum: 100
            minimum: 1
            type: number
        - name: trackTotalHits
          in: query
          description: Whether to track total hit count.
          schema:
            type: boolean
      responses:
        '200':
          description: Indicates a successful response
          content:
            application/json:
              examples:
                searchExecutionsResponseExample:
                  description: Example paginated list of workflow-level executions
                  value:
                    page: 1
                    results:
                      - duration: 3000
                        error: 'null'
                        executedBy: elastic
                        finishedAt: '2025-11-20T12:00:03.000Z'
                        id: exec-a1b2c3d4-e5f6-7890
                        isTestRun: false
                        managed: false
                        spaceId: default
                        startedAt: '2025-11-20T12:00:00.000Z'
                        status: completed
                        tags:
                          - reporting
                        triggeredBy: manual
                        workflowId: workflow-a1b2c3d4-e5f6-7890-abcd-ef1234567890
                        workflowName: Example Workflow
                    size: 25
                    total: 1
        '400':
          description: 'Indicates a bad request, such as invalid KQL syntax'
          content:
            application/json:
              examples:
                searchExecutionsBadRequestExample:
                  description: Example response when the kql parameter contains invalid syntax
                  value:
                    message: 'Invalid KQL: Expected AND, OR, or end of input but "f" found.'
      x-codeSamples:
        - lang: curl
          source: "curl \\\n  -X GET \"${KIBANA_URL}/api/workflows/workflow/executions?page=1&size=25&trackTotalHits=true&kql=startedAt%20%3E%3D%20%22now-15m%22&sortField=startedAt&sortOrder=desc\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n"
        - lang: Console
          source: "GET kbn://api/workflows/workflow/executions?from=0&size=25&trackTotalHits=true&kql=startedAt >= \"now-15m\"&sortField=startedAt&sortOrder=desc\n"
      x-state: Generally available; added in 9.4.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos':
    get:
      tags:
        - slo
      summary: Get a paginated list of SLOs
      description: "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: findSlosOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - name: kqlQuery
          in: query
          description: A valid kql query to filter the SLO with
          schema:
            type: string
          example: 'slo.name:latency* and slo.tags : "prod"'
        - name: size
          in: query
          description: 'The page size to use for cursor-based pagination, must be greater or equal than 1'
          schema:
            type: integer
            default: 1
          example: 1
        - name: searchAfter
          in: query
          description: 'The cursor to use for fetching the results from, when using a cursor-base pagination.'
          schema:
            type: array
            items:
              type: string
        - name: page
          in: query
          description: 'The page to use for pagination, must be greater or equal than 1'
          schema:
            type: integer
            default: 1
          example: 1
        - name: perPage
          in: query
          description: Number of SLOs returned by page
          schema:
            maximum: 5000
            type: integer
            default: 25
          example: 25
        - name: sortBy
          in: query
          description: Sort by field
          schema:
            enum:
              - sli_value
              - status
              - error_budget_consumed
              - error_budget_remaining
            type: string
            default: status
          example: status
        - name: sortDirection
          in: query
          description: Sort order
          schema:
            enum:
              - asc
              - desc
            type: string
            default: asc
          example: asc
        - name: hideStale
          in: query
          description: Hide stale SLOs from the list as defined by stale SLO threshold in SLO settings
          schema:
            type: boolean
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_find_slo_response'
              examples:
                findSloResponse:
                  summary: A paginated list of SLOs
                  value:
                    page: 1
                    perPage: 25
                    results:
                      - budgetingMethod: occurrences
                        createdAt: '2025-01-12T10:03:19.000Z'
                        description: Availability of my web service
                        enabled: true
                        groupBy: '*'
                        id: 8853df00-ae2e-11ed-90af-09bb6422b258
                        indicator:
                          params:
                            filter: 'field.environment : "production" and service.name : "my-service"'
                            good: 'request.status_code : "2xx"'
                            index: logs-*
                            timestampField: '@timestamp'
                            total: 'request.status_code : *'
                          type: sli.kql.custom
                        instanceId: '*'
                        name: My Service Availability
                        objective:
                          target: 0.99
                        revision: 1
                        settings:
                          frequency: 5m
                          syncDelay: 5m
                        summary:
                          errorBudget:
                            consumed: 0.17
                            initial: 0.01
                            isEstimated: false
                            remaining: 0.83
                          sliValue: 0.9983
                          status: HEALTHY
                        tags:
                          - production
                          - web-service
                        timeWindow:
                          duration: 30d
                          type: rolling
                        updatedAt: '2025-01-12T10:03:19.000Z'
                        version: 2
                    total: 42
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''invalid'' supplied to: sortBy'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_read] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    post:
      tags:
        - slo
      summary: Create an SLO
      description: "You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: createSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SLOs_create_slo_request'
            examples:
              createSloKqlExample:
                summary: Create an SLO with a KQL indicator
                value:
                  budgetingMethod: occurrences
                  description: Availability of my web service measured by successful HTTP responses
                  indicator:
                    params:
                      filter: 'field.environment : "production" and service.name : "my-service"'
                      good: 'request.status_code : "2xx"'
                      index: logs-*
                      timestampField: '@timestamp'
                      total: 'request.status_code : *'
                    type: sli.kql.custom
                  name: My Service Availability
                  objective:
                    target: 0.99
                  settings:
                    frequency: 5m
                    syncDelay: 5m
                  tags:
                    - production
                    - web-service
                  timeWindow:
                    duration: 30d
                    type: rolling
        required: true
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_create_slo_response'
              examples:
                createSloResponse:
                  summary: Create SLO response
                  value:
                    id: 8853df00-ae2e-11ed-90af-09bb6422b258
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: indicator/type'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
        '409':
          description: Conflict - The SLO id already exists
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_409_response'
              examples:
                conflictExample:
                  summary: Conflict
                  value:
                    error: Conflict
                    message: 'SLO [d077e940-1515-11ee-9c50-9d096392f520] already exists'
                    statusCode: 409
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/_bulk_delete':
    post:
      tags:
        - slo
      summary: Bulk delete SLO definitions and their associated summary and rollup data.
      description: "Bulk delete SLO definitions and their associated summary and rollup data.  This endpoint initiates a bulk deletion operation for SLOs, which may take some time to complete.  The status of the operation can be checked using the `GET /api/slo/_bulk_delete/{taskId}` endpoint.\n"
      operationId: bulkDeleteOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SLOs_bulk_delete_request'
            examples:
              bulkDeleteRequest:
                summary: Bulk delete two SLOs
                value:
                  list:
                    - 8853df00-ae2e-11ed-90af-09bb6422b258
                    - d077e940-1515-11ee-9c50-9d096392f520
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_bulk_delete_response'
              examples:
                bulkDeleteResponse:
                  summary: Bulk delete response with task ID
                  value:
                    taskId: d08506b7-f0e8-4f8b-a06a-a83940f4db91
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: list'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/_bulk_delete/{taskId}':
    get:
      tags:
        - slo
      summary: Retrieve the status of the bulk deletion
      description: "Retrieve the status of the bulk deletion operation for SLOs.  This endpoint returns the status of the bulk deletion operation, including whether it is completed and the results of the operation.\n"
      operationId: bulkDeleteStatusOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - name: taskId
          in: path
          description: The task id of the bulk delete operation
          required: true
          schema:
            type: string
            example: 8853df00-ae2e-11ed-90af-09bb6422b258
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_bulk_delete_status_response'
              examples:
                bulkDeleteStatusComplete:
                  summary: Completed bulk deletion
                  value:
                    isDone: true
                    results:
                      - id: 8853df00-ae2e-11ed-90af-09bb6422b258
                        success: true
                      - id: d077e940-1515-11ee-9c50-9d096392f520
                        success: true
                bulkDeleteStatusPartialFailure:
                  summary: Completed with partial failure
                  value:
                    isDone: true
                    results:
                      - id: 8853df00-ae2e-11ed-90af-09bb6422b258
                        success: true
                      - error: 'SLO [d077e940-1515-11ee-9c50-9d096392f520] not found'
                        id: d077e940-1515-11ee-9c50-9d096392f520
                        success: false
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: taskId'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/_bulk_purge_rollup':
    post:
      tags:
        - slo
      summary: Batch delete rollup and summary data
      description: "The deletion occurs for the specified list of `sloId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: deleteRollupDataOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SLOs_bulk_purge_rollup_request'
            examples:
              purgeByAgeExample:
                summary: Purge rollup data older than 7 days
                value:
                  list:
                    - 8853df00-ae2e-11ed-90af-09bb6422b258
                  purgePolicy:
                    age: 7d
                    purgeType: fixed-age
              purgeByTimestampExample:
                summary: Purge rollup data before a specific date
                value:
                  list:
                    - 8853df00-ae2e-11ed-90af-09bb6422b258
                    - d077e940-1515-11ee-9c50-9d096392f520
                  purgePolicy:
                    purgeType: fixed-time
                    timestamp: '2024-12-31T00:00:00.000Z'
        required: true
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_bulk_purge_rollup_response'
              examples:
                bulkPurgeResponse:
                  summary: Bulk purge response with task ID
                  value:
                    taskId: 8853df00-ae2e-11ed-90af-09bb6422b258
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: purgePolicy/purgeType'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/_bulk_snapshot':
    post:
      tags:
        - slo
      summary: Compute SLO instance summaries in bulk at a point in time
      description: "Compute the summary of multiple SLO instances at a given point in time. The endpoint is synchronous and returns results directly. Each result contains either a summary (on success) or a per-instance error. The list of requests is limited to 100 entries. When `instanceId` is omitted or set to `'*'`, the API returns a result for each matching instance (up to 1000 per SLO). You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: bulkSnapshotOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SLOs_bulk_snapshot_request'
            examples:
              bulkSnapshotRequest:
                summary: Compute snapshots for two SLO instances
                value:
                  at: '2025-01-12T10:00:00.000Z'
                  requests:
                    - id: 8853df00-ae2e-11ed-90af-09bb6422b258
                      instanceId: '*'
                    - id: d077e940-1515-11ee-9c50-9d096392f520
                      instanceId: host.name:web-01
        required: true
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_snapshot_response'
              examples:
                bulkSnapshotResponse:
                  summary: Bulk snapshot response with mixed success and per-instance error
                  value:
                    at: '2025-01-12T10:00:00.000Z'
                    results:
                      - id: 8853df00-ae2e-11ed-90af-09bb6422b258
                        instanceId: '*'
                        summary:
                          errorBudget:
                            consumed: 0.24
                            initial: 0.01
                            remaining: 0.76
                          good: 9976
                          sliValue: 0.9976
                          status: HEALTHY
                          total: 10000
                      - error:
                          message: 'SLO [d077e940-1515-11ee-9c50-9d096392f520] not found'
                          statusCode: 404
                        id: d077e940-1515-11ee-9c50-9d096392f520
                        instanceId: host.name:web-01
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: '`requests` is limited to 100 entries'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_read] is unauthorized for user'
                    statusCode: 403
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/_delete_instances':
    post:
      tags:
        - slo
      summary: Batch delete rollup and summary data
      description: "The deletion occurs for the specified list of `sloId` and `instanceId`. You must have `all` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: deleteSloInstancesOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SLOs_delete_slo_instances_request'
            examples:
              deleteInstancesExample:
                summary: Delete specific SLO instances
                value:
                  list:
                    - instanceId: host-abc123
                      sloId: 8853df00-ae2e-11ed-90af-09bb6422b258
                    - instanceId: host-def456
                      sloId: 8853df00-ae2e-11ed-90af-09bb6422b258
        required: true
      responses:
        '204':
          description: Successful request
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: list/0/sloId'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/{sloId}':
    delete:
      tags:
        - slo
      summary: Delete an SLO
      description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: deleteSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
      responses:
        '204':
          description: Successful request
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: id'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    get:
      tags:
        - slo
      summary: Get an SLO
      description: "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: getSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
        - name: instanceId
          in: query
          description: the specific instanceId used by the summary calculation
          schema:
            type: string
          example: host-abcde
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_slo_with_summary_response'
              examples:
                getSloResponse:
                  summary: Get SLO response
                  value:
                    budgetingMethod: occurrences
                    createdAt: '2025-01-12T10:03:19.000Z'
                    description: Availability of my web service
                    enabled: true
                    groupBy: '*'
                    id: 8853df00-ae2e-11ed-90af-09bb6422b258
                    indicator:
                      params:
                        filter: 'field.environment : "production" and service.name : "my-service"'
                        good: 'request.status_code : "2xx"'
                        index: logs-*
                        timestampField: '@timestamp'
                        total: 'request.status_code : *'
                      type: sli.kql.custom
                    instanceId: '*'
                    name: My Service Availability
                    objective:
                      target: 0.99
                    revision: 1
                    settings:
                      frequency: 5m
                      syncDelay: 5m
                    summary:
                      errorBudget:
                        consumed: 0.17
                        initial: 0.01
                        isEstimated: false
                        remaining: 0.83
                      sliValue: 0.9983
                      status: HEALTHY
                    tags:
                      - production
                      - web-service
                    timeWindow:
                      duration: 30d
                      type: rolling
                    updatedAt: '2025-01-12T10:03:19.000Z'
                    version: 2
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: id'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_read] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
    put:
      tags:
        - slo
      summary: Update an SLO
      description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: updateSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
      requestBody:
        content:
          application/json:
            schema:
              $ref: '#/components/schemas/SLOs_update_slo_request'
            examples:
              updateSloNameExample:
                summary: Update the SLO name and tags
                value:
                  name: Updated Service Availability
                  tags:
                    - production
                    - updated
              updateSloObjectiveExample:
                summary: Update the SLO objective
                value:
                  objective:
                    target: 0.995
        required: true
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_slo_definition_response'
              examples:
                updateSloResponse:
                  summary: Update SLO response
                  value:
                    budgetingMethod: occurrences
                    createdAt: '2025-01-12T10:03:19.000Z'
                    description: Availability of my web service
                    enabled: true
                    groupBy: '*'
                    id: 8853df00-ae2e-11ed-90af-09bb6422b258
                    indicator:
                      params:
                        filter: 'field.environment : "production" and service.name : "my-service"'
                        good: 'request.status_code : "2xx"'
                        index: logs-*
                        timestampField: '@timestamp'
                        total: 'request.status_code : *'
                      type: sli.kql.custom
                    name: Updated Service Availability
                    objective:
                      target: 0.99
                    revision: 2
                    settings:
                      frequency: 5m
                      syncDelay: 5m
                    tags:
                      - production
                      - updated
                    timeWindow:
                      duration: 30d
                      type: rolling
                    updatedAt: '2025-03-26T14:30:00.000Z'
                    version: 2
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: indicator/type'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/{sloId}/_reset':
    post:
      tags:
        - slo
      summary: Reset an SLO
      description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: resetSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_slo_definition_response'
              examples:
                resetSloResponse:
                  summary: Reset SLO response
                  value:
                    budgetingMethod: occurrences
                    createdAt: '2025-01-12T10:03:19.000Z'
                    description: Availability of my web service
                    enabled: true
                    groupBy: '*'
                    id: 8853df00-ae2e-11ed-90af-09bb6422b258
                    indicator:
                      params:
                        filter: 'field.environment : "production" and service.name : "my-service"'
                        good: 'request.status_code : "2xx"'
                        index: logs-*
                        timestampField: '@timestamp'
                        total: 'request.status_code : *'
                      type: sli.kql.custom
                    name: My Service Availability
                    objective:
                      target: 0.99
                    revision: 2
                    settings:
                      frequency: 5m
                      syncDelay: 5m
                    tags:
                      - production
                      - web-service
                    timeWindow:
                      duration: 30d
                      type: rolling
                    updatedAt: '2025-03-26T14:30:00.000Z'
                    version: 2
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: id'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/{sloId}/_snapshot':
    get:
      tags:
        - slo
      summary: Compute an SLO instance summary at a point in time
      description: "Compute the summary of an SLO at a given point in time. When `instanceId` is provided, returns that instance. When `instanceId` is omitted or set to `'*'`, returns all matching instances (up to 1000). The endpoint is synchronous and returns results directly. You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: getSnapshotOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
        - name: at
          in: query
          description: The point in time at which to compute the SLO instance summary (ISO 8601 date-time)
          required: true
          schema:
            type: string
            format: date-time
            example: '2025-01-12T10:00:00.000Z'
        - name: instanceId
          in: query
          description: "The SLO instance ID. Omit this parameter or set it to `'*'` to return all instances for the SLO (up to 1000). Set a specific value (for example `host.name:web-01`) to return that instance only.\n"
          schema:
            type: string
            example: '*'
      responses:
        '200':
          description: Successful response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_snapshot_response'
              examples:
                getSnapshotResponse:
                  summary: Snapshot result for a healthy SLO instance
                  value:
                    at: '2025-01-12T10:00:00.000Z'
                    results:
                      - id: 8853df00-ae2e-11ed-90af-09bb6422b258
                        instanceId: '*'
                        summary:
                          errorBudget:
                            consumed: 0.24
                            initial: 0.01
                            remaining: 0.76
                          good: 9976
                          sliValue: 0.9976
                          status: HEALTHY
                          total: 10000
                getSnapshotResponseViolated:
                  summary: Snapshot result for a violated SLO instance
                  value:
                    at: '2025-01-12T10:00:00.000Z'
                    results:
                      - id: 8853df00-ae2e-11ed-90af-09bb6422b258
                        instanceId: host.name:web-01
                        summary:
                          errorBudget:
                            consumed: 5
                            initial: 0.01
                            remaining: -4
                          good: 9500
                          sliValue: 0.95
                          status: VIOLATED
                          total: 10000
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: at'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_read] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [8853df00-ae2e-11ed-90af-09bb6422b258] not found'
                    statusCode: 404
      x-state: Generally available; added in 9.6.0
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/{sloId}/disable':
    post:
      tags:
        - slo
      summary: Disable an SLO
      description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: disableSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
      responses:
        '204':
          description: Successful request
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: id'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/api/observability/slos/{sloId}/enable':
    post:
      tags:
        - slo
      summary: Enable an SLO
      description: "You must have the `write` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: enableSloOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - $ref: '#/components/parameters/SLOs_slo_id'
      responses:
        '204':
          description: Successful request
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
              examples:
                badRequestExample:
                  summary: Bad request
                  value:
                    error: Bad Request
                    message: 'Invalid value ''foo'' supplied to: id'
                    statusCode: 400
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
              examples:
                unauthorizedExample:
                  summary: Unauthorized
                  value:
                    error: Unauthorized
                    message: 'security_exception: unable to authenticate user for REST request [/api/observability/slos]'
                    statusCode: 401
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
              examples:
                forbiddenExample:
                  summary: Forbidden
                  value:
                    error: Forbidden
                    message: 'security_exception: action [slo_write] is unauthorized for user'
                    statusCode: 403
        '404':
          description: Not found response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_404_response'
              examples:
                notFoundExample:
                  summary: Not found
                  value:
                    error: Not Found
                    message: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
                    statusCode: 404
      x-metaTags:
        - content: Kibana
          name: product_name
  '/s/{spaceId}/internal/observability/slos/_definitions':
    get:
      tags:
        - slo
      summary: Get the SLO definitions
      description: "You must have the `read` privileges for the **SLOs** feature in the **Observability** section of the Kibana feature privileges.\n"
      operationId: getDefinitionsOp
      parameters:
        - $ref: '#/components/parameters/SLOs_kbn_xsrf'
        - $ref: '#/components/parameters/SLOs_space_id'
        - name: includeOutdatedOnly
          in: query
          description: Indicates if the API returns only outdated SLO or all SLO definitions
          schema:
            type: boolean
        - name: includeHealth
          in: query
          description: Indicates if the API returns SLO health data with definitions
          schema:
            type: boolean
          example: true
        - name: tags
          in: query
          description: Filters the SLOs by tag
          schema:
            type: string
        - name: search
          in: query
          description: Filters the SLOs by name
          schema:
            type: string
          example: my service availability
        - name: page
          in: query
          description: 'The page to use for pagination, must be greater or equal than 1'
          schema:
            type: number
          example: 1
        - name: perPage
          in: query
          description: Number of SLOs returned by page
          schema:
            maximum: 1000
            type: integer
            default: 100
          example: 100
      responses:
        '200':
          description: Successful request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_find_slo_definitions_response'
        '400':
          description: Bad request
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_400_response'
        '401':
          description: Unauthorized response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_401_response'
        '403':
          description: Forbidden response
          content:
            application/json:
              schema:
                $ref: '#/components/schemas/SLOs_403_response'
      x-metaTags:
        - content: Kibana
          name: product_name
components:
  schemas:
    Alerting_401_response:
      title: Unsuccessful rule API response
      type: object
      properties:
        error:
          enum:
            - Unauthorized
          type: string
          example: Unauthorized
        message:
          type: string
        statusCode:
          enum:
            - 401
          type: integer
          example: 401
    Alerting_fieldmap_properties:
      title: Field map objects in the get rule types response
      type: object
      properties:
        array:
          type: boolean
          description: Indicates whether the field is an array.
        dynamic:
          type: boolean
          description: Indicates whether it is a dynamic field mapping.
        format:
          type: string
          description: "Indicates the format of the field. For example, if the `type` is `date_range`, the `format` can be `epoch_millis||strict_date_optional_time`.\n"
        ignore_above:
          type: integer
          description: Specifies the maximum length of a string field. Longer strings are not indexed or stored.
        index:
          type: boolean
          description: Indicates whether field values are indexed.
        path:
          type: string
          description: TBD
        properties:
          type: object
          additionalProperties:
            type: object
            properties:
              type:
                type: string
                description: The data type for each object property.
          description: "Details about the object properties. This property is applicable when `type` is `object`.\n"
        required:
          type: boolean
          description: Indicates whether the field is required.
        scaling_factor:
          type: integer
          description: "The scaling factor to use when encoding values. This property is applicable when `type` is `scaled_float`. Values will be multiplied by this factor at index time and rounded to the closest long value. \n"
        type:
          type: string
          description: Specifies the data type for the field.
          example: scaled_float
    APM_UI_400_response:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Not Found
        message:
          type: string
          description: Error message
          example: Not Found
        statusCode:
          type: number
          description: Error status code
          example: 400
    APM_UI_401_response:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Unauthorized
        message:
          type: string
          description: Error message
        statusCode:
          type: number
          description: Error status code
          example: 401
    APM_UI_403_response:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Forbidden
        message:
          type: string
          description: Error message
        statusCode:
          type: number
          description: Error status code
          example: 403
    APM_UI_404_response:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Not Found
        message:
          type: string
          description: Error message
          example: Not Found
        statusCode:
          type: number
          description: Error status code
          example: 404
    APM_UI_500_response:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Internal Server Error
        message:
          type: string
          description: Error message
        statusCode:
          type: number
          description: Error status code
          example: 500
    APM_UI_501_response:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Not Implemented
        message:
          type: string
          description: Error message
          example: Not Implemented
        statusCode:
          type: number
          description: Error status code
          example: 501
    APM_UI_agent_configuration_intake_object:
      required:
        - service
        - settings
      type: object
      properties:
        agent_name:
          type: string
          description: The agent name is used by the UI to determine which settings to display.
        service:
          $ref: '#/components/schemas/APM_UI_service_object'
        settings:
          $ref: '#/components/schemas/APM_UI_settings_object'
    APM_UI_agent_configuration_object:
      required:
        - service
        - settings
        - '@timestamp'
        - etag
      type: object
      properties:
        '@timestamp':
          type: number
          description: Timestamp
          example: 1730194190636
        agent_name:
          type: string
          description: Agent name
        applied_by_agent:
          type: boolean
          description: Applied by agent
          example: true
        etag:
          type: string
          description: "`etag` is sent by the APM agent to indicate the `etag` of the last successfully applied configuration. If the `etag` matches an existing configuration its `applied_by_agent` property will be set to `true`. Every time a configuration is edited `applied_by_agent` is reset to `false`.\n"
          example: 0bc3b5ebf18fba8163fe4c96f491e3767a358f85
        service:
          $ref: '#/components/schemas/APM_UI_service_object'
        settings:
          $ref: '#/components/schemas/APM_UI_settings_object'
      description: Agent configuration
    APM_UI_agent_configurations_response:
      type: object
      properties:
        configurations:
          type: array
          items:
            $ref: '#/components/schemas/APM_UI_agent_configuration_object'
          description: Agent configuration
    APM_UI_agent_keys_object:
      required:
        - name
        - privileges
      type: object
      properties:
        name:
          type: string
          description: The name of the APM agent key.
        privileges:
          type: array
          items:
            enum:
              - event:write
              - config_agent:read
            type: string
          description: "The APM agent key privileges. It can take one or more of the following values:\n* `event:write`, which is required for ingesting APM agent events. * `config_agent:read`, which is required for APM agents to read agent configuration remotely.\n"
    APM_UI_agent_keys_response:
      type: object
      properties:
        agentKey:
          required:
            - id
            - name
            - api_key
            - encoded
          type: object
          properties:
            api_key:
              type: string
            encoded:
              type: string
            expiration:
              type: integer
              format: int64
            id:
              type: string
            name:
              type: string
          description: Agent key
    APM_UI_annotation_search_response:
      type: object
      properties:
        annotations:
          type: array
          items:
            type: object
            properties:
              '@timestamp':
                type: number
              id:
                type: string
              text:
                type: string
              type:
                enum:
                  - version
                type: string
          description: Annotations
    APM_UI_base_source_map_object:
      type: object
      properties:
        compressionAlgorithm:
          type: string
          description: Compression Algorithm
        created:
          type: string
          description: Created date
        decodedSha256:
          type: string
          description: Decoded SHA-256
        decodedSize:
          type: number
          description: Decoded size
        encodedSha256:
          type: string
          description: Encoded SHA-256
        encodedSize:
          type: number
          description: Encoded size
        encryptionAlgorithm:
          type: string
          description: Encryption Algorithm
        id:
          type: string
          description: Identifier
        identifier:
          type: string
          description: Identifier
        packageName:
          type: string
          description: Package name
        relative_url:
          type: string
          description: Relative URL
        type:
          type: string
          description: Type
    APM_UI_create_annotation_object:
      required:
        - '@timestamp'
        - service
      type: object
      properties:
        '@timestamp':
          type: string
          description: The date and time of the annotation. It must be in ISO 8601 format.
        message:
          type: string
          description: The message displayed in the annotation. It defaults to `service.version`.
        service:
          required:
            - version
          type: object
          properties:
            environment:
              type: string
              description: The environment of the service.
            version:
              type: string
              description: The version of the service.
          description: The service that identifies the configuration to create or update.
        tags:
          type: array
          items:
            type: string
          description: "Tags are used by the Applications UI to distinguish APM annotations from other annotations. Tags may have additional functionality in future releases. It defaults to `[apm]`. While you can add additional tags, you cannot remove the `apm` tag.\n"
    APM_UI_create_annotation_response:
      type: object
      properties:
        _id:
          type: string
          description: Identifier
        _index:
          type: string
          description: Index
        _source:
          type: object
          properties:
            '@timestamp':
              type: string
            annotation:
              type: object
              properties:
                title:
                  type: string
                type:
                  type: string
            event:
              type: object
              properties:
                created:
                  type: string
            message:
              type: string
            service:
              type: object
              properties:
                environment:
                  type: string
                name:
                  type: string
                version:
                  type: string
            tags:
              type: array
              items:
                type: string
          description: Response
    APM_UI_delete_agent_configurations_response:
      type: object
      properties:
        result:
          type: string
          description: Result
    APM_UI_delete_service_object:
      required:
        - service
      type: object
      properties:
        service:
          $ref: '#/components/schemas/APM_UI_service_object'
      description: Service
    APM_UI_search_agent_configuration_object:
      required:
        - service
      type: object
      properties:
        error:
          type: string
          description: "If provided, the agent configuration will be marked as error and `applied_by_agent` will be set to `false`.\nThis is useful for cases where the agent configuration was not applied successfully.\n"
        etag:
          type: string
          description: If etags match then `applied_by_agent` field will be set to `true`
          example: 0bc3b5ebf18fba8163fe4c96f491e3767a358f85
        mark_as_applied_by_agent:
          type: boolean
          description: "`markAsAppliedByAgent=true` means \"force setting it to true regardless of etag\".\nThis is needed for Jaeger agent that doesn't have etags\n"
        service:
          $ref: '#/components/schemas/APM_UI_service_object'
    APM_UI_search_agent_configuration_response:
      type: object
      properties:
        _id:
          type: string
          description: Identifier
        _index:
          type: string
          description: Index
        _score:
          type: number
          description: Score
        _source:
          $ref: '#/components/schemas/APM_UI_agent_configuration_object'
    APM_UI_service_agent_name_response:
      type: object
      properties:
        agentName:
          type: string
          description: Agent name
          example: nodejs
    APM_UI_service_environment_object:
      type: object
      properties:
        alreadyConfigured:
          type: boolean
          description: Already configured
        name:
          type: string
          description: Service environment name
          example: ALL_OPTION_VALUE
    APM_UI_service_environments_response:
      type: object
      properties:
        environments:
          type: array
          items:
            $ref: '#/components/schemas/APM_UI_service_environment_object'
          description: Service environment list
    APM_UI_service_object:
      type: object
      properties:
        environment:
          type: string
          description: The environment of the service.
          example: prod
        name:
          type: string
          description: The name of the service.
          example: node
      description: Service
    APM_UI_settings_object:
      type: object
      additionalProperties:
        type: string
      description: Agent configuration settings
    APM_UI_single_agent_configuration_response:
      allOf:
        - required:
            - id
          type: object
          properties:
            id:
              type: string
        - $ref: '#/components/schemas/APM_UI_agent_configuration_object'
    APM_UI_source_maps_response:
      type: object
      properties:
        artifacts:
          type: array
          items:
            allOf:
              - type: object
                properties:
                  body:
                    type: object
                    properties:
                      bundleFilepath:
                        type: string
                      serviceName:
                        type: string
                      serviceVersion:
                        type: string
                      sourceMap:
                        type: object
                        properties:
                          file:
                            type: string
                          mappings:
                            type: string
                          sourceRoot:
                            type: string
                          sources:
                            type: array
                            items:
                              type: string
                          sourcesContent:
                            type: array
                            items:
                              type: string
                          version:
                            type: number
              - $ref: '#/components/schemas/APM_UI_base_source_map_object'
          description: Artifacts
    APM_UI_upload_source_map_object:
      required:
        - service_name
        - service_version
        - bundle_filepath
        - sourcemap
      type: object
      properties:
        bundle_filepath:
          type: string
          description: The absolute path of the final bundle as used in the web application.
        service_name:
          type: string
          description: The name of the service that the service map should apply to.
        service_version:
          type: string
          description: The version of the service that the service map should apply to.
        sourcemap:
          type: string
          description: "The source map. It can be a string or file upload. It must follow the\n[source map format specification](https://tc39.es/ecma426/).\n"
          format: binary
    APM_UI_upload_source_maps_response:
      allOf:
        - type: object
          properties:
            body:
              type: string
        - $ref: '#/components/schemas/APM_UI_base_source_map_object'
    Cases_actions:
      enum:
        - add
        - create
        - delete
        - push_to_service
        - update
      type: string
      example: create
    Cases_add_alert_comment_request_properties:
      title: Add case comment request properties for alerts
      required:
        - alertId
        - index
        - owner
        - rule
        - type
      type: object
      properties:
        alertId:
          $ref: '#/components/schemas/Cases_alert_identifiers'
        index:
          $ref: '#/components/schemas/Cases_alert_indices'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        rule:
          $ref: '#/components/schemas/Cases_rule'
        type:
          enum:
            - alert
          type: string
          description: The type of comment.
          example: alert
      description: Defines properties for case comment requests when type is alert.
    Cases_add_case_comment_request:
      title: Add case comment request
      oneOf:
        - $ref: '#/components/schemas/Cases_add_alert_comment_request_properties'
        - $ref: '#/components/schemas/Cases_add_user_comment_request_properties'
      description: The add comment to case API request body varies depending on whether you are adding an alert or a comment.
      discriminator:
        propertyName: type
        mapping:
          alert: '#/components/schemas/Cases_add_alert_comment_request_properties'
          user: '#/components/schemas/Cases_add_user_comment_request_properties'
    Cases_add_case_file_request:
      title: Add case file request properties
      required:
        - file
      type: object
      properties:
        file:
          type: string
          description: The file being attached to the case.
          format: binary
        filename:
          type: string
          description: 'The desired name of the file being attached to the case, it can be different than the name of the file in the filesystem. **This should not include the file extension.**'
      description: Defines the file that will be attached to the case. Optional parameters will be generated automatically from the file metadata if not defined.
    Cases_add_user_comment_request_properties:
      title: Add case comment request properties for user comments
      required:
        - comment
        - owner
        - type
      type: object
      properties:
        comment:
          maxLength: 30000
          type: string
          description: The new comment. It is required only when `type` is `user`.
          example: A new comment.
        owner:
          $ref: '#/components/schemas/Cases_owner'
        type:
          enum:
            - user
          type: string
          description: The type of comment.
          example: user
      description: Defines properties for case comment requests when type is user.
    Cases_alert_comment_response_properties:
      title: Add case comment response properties for alerts
      required:
        - type
      type: object
      properties:
        alertId:
          type: array
          items:
            type: string
            example: a6e12ac4-7bce-457b-84f6-d7ce8deb8446
        created_at:
          type: string
          format: date-time
          example: '2023-11-06T19:29:38.424Z'
        created_by:
          required:
            - email
            - full_name
            - username
          type: object
          properties:
            email:
              type:
                - 'null'
                - string
              example: 'null'
            full_name:
              type:
                - 'null'
                - string
              example: 'null'
            profile_uid:
              type: string
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
            username:
              type:
                - 'null'
                - string
              example: elastic
        id:
          type: string
          example: 73362370-ab1a-11ec-985f-97e55adae8b9
        index:
          type: array
          items:
            type: string
            example: .internal.alerts-security.alerts-default-000001
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          type:
            - 'null'
            - string
          format: date-time
          example: 'null'
        pushed_by:
          required:
            - email
            - full_name
            - username
          type:
            - 'null'
            - object
          properties:
            email:
              type:
                - 'null'
                - string
              example: 'null'
            full_name:
              type:
                - 'null'
                - string
              example: 'null'
            profile_uid:
              type: string
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
            username:
              type:
                - 'null'
                - string
              example: elastic
        rule:
          type: object
          properties:
            id:
              type:
                - 'null'
                - string
              description: The rule identifier.
              example: 94d80550-aaf4-11ec-985f-97e55adae8b9
            name:
              type:
                - 'null'
                - string
              description: The rule name.
              example: security_rule
        type:
          enum:
            - alert
          type: string
          example: alert
        updated_at:
          type:
            - 'null'
            - string
          format: date-time
        updated_by:
          required:
            - email
            - full_name
            - username
          type:
            - 'null'
            - object
          properties:
            email:
              type:
                - 'null'
                - string
              example: 'null'
            full_name:
              type:
                - 'null'
                - string
              example: 'null'
            profile_uid:
              type: string
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
            username:
              type:
                - 'null'
                - string
              example: elastic
        version:
          type: string
          example: WzMwNDgsMV0=
    Cases_alert_identifiers:
      title: Alert identifiers
      oneOf:
        - type: string
        - maxItems: 1000
          type: array
          items:
            type: string
      description: "The alert identifiers. It is required only when `type` is `alert`. You can use an array of strings to add multiple alerts to a case, provided that they all relate to the same rule; `index` must also be an array with the same length or number of elements. Adding multiple alerts in this manner is recommended rather than calling the API multiple times. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
      example: 6b24c4dc44bc720cfc92797f3d61fff952f2b2627db1fb4f8cc49f4530c4ff42
      x-state: Technical preview
    Cases_alert_indices:
      title: Alert indices
      oneOf:
        - type: string
        - maxItems: 1000
          type: array
          items:
            type: string
      description: "The alert indices. It is required only when `type` is `alert`. If you are adding multiple alerts to a case, use an array of strings; the position of each index name in the array must match the position of the corresponding alert identifier in the `alertId` array.  This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
      x-state: Technical preview
    Cases_alert_response_properties:
      type: object
      properties:
        attached_at:
          type: string
          format: date-time
        id:
          type: string
          description: The alert identifier.
        index:
          type: string
          description: The alert index.
    Cases_applicable_fields_response:
      required:
        - fields
      type: object
      properties:
        fields:
          type: array
          items:
            required:
              - key
              - name
              - label
              - type
              - control
              - required
              - requiredOnClose
              - displayOnly
              - source
              - isGlobal
            type: object
            properties:
              control:
                type: string
                description: "The UI control for the field, such as `INPUT_TEXT`, `INPUT_NUMBER`, `SELECT_BASIC`, `TOGGLE`, or `MARKDOWN`.\n"
                example: SELECT_BASIC
              defaultValue:
                type: string
                description: 'The default value, as a string, when the field definition declares one.'
              displayOnly:
                type: boolean
                description: "When `true` the field is display-only (for example a `MARKDOWN` block): it is returned so the full form shape is visible, but it holds no value and its `key` cannot be written to `extended_fields`.\n"
              isGlobal:
                type: boolean
                description: Whether the field is a global (library-wide) definition.
              key:
                type: string
                description: "The storage key to write in the case `extended_fields` map. Follows the `<field_name>_as_<storage_type>` convention (for example `priority_as_keyword`).\n"
                example: priority_as_keyword
              label:
                type: string
                description: The human-readable label. Falls back to `name` when no label is authored.
                example: Priority
              name:
                type: string
                description: The field name as authored in the field definition.
                example: priority
              options:
                type: array
                items:
                  type: string
                description: 'The allowed values for `SELECT_BASIC`, `RADIO_GROUP`, and `CHECKBOX_GROUP` fields.'
              type:
                type: string
                description: 'The storage type: `keyword`, `integer`, `long`, `boolean`, or `date`.'
                example: keyword
              required:
                type: boolean
                description: Whether a value must be supplied at write time.
              requiredOnClose:
                type: boolean
                description: Whether the field must be filled before the case can be closed.
              source:
                enum:
                  - global
                  - template
                type: string
                description: "Where the field comes from: `global` for a library-wide (`isGlobal`) definition writable on any case, or `template` for a field contributed by the applied template.\n"
      description: "The fields a caller may apply to a case's `extended_fields`. When no template is in scope, this is the owner's global (library-wide) fields; when a template is applied, it also includes that template's fields. Migrated legacy custom fields appear here as `global` fields, so existing automations can look up the exact key to write.\n"
    Cases_assignees:
      maxItems: 10
      type:
        - 'null'
        - array
      items:
        required:
          - uid
        type: object
        properties:
          uid:
            type: string
            description: A unique identifier for the user profile. These identifiers can be found by using the suggest user profile API.
            example: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
      description: An array containing users that are assigned to the case.
    Cases_attachment_totals:
      title: Attachment totals
      required:
        - alerts
        - events
        - userComments
      type: object
      properties:
        alerts:
          type: integer
          description: Number of alert attachments on the case.
        events:
          type: integer
          description: Number of event attachments on the case.
        userComments:
          type: integer
          description: Number of user comment attachments on the case.
      description: 'Counts of alerts, events, and user comments attached to a case.'
    Cases_case_categories:
      maxItems: 100
      type: array
      items:
        $ref: '#/components/schemas/Cases_case_category'
    Cases_case_category:
      maxLength: 50
      type: string
      description: A word or phrase that categorizes the case.
    Cases_case_close_sync_reason:
      oneOf:
        - enum:
            - false_positive
            - duplicate
            - true_positive
            - benign_positive
            - automated_closure
            - other
          type: string
        - type: string
      description: "The close reason to sync to attached alerts when closing the case. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user.\n"
    Cases_case_description:
      maxLength: 30000
      type: string
      description: The description for the case.
    Cases_case_extended_fields:
      title: Case extended fields
      maxProperties: 500
      type: object
      additionalProperties:
        maxLength: 30000
        type: string
      description: "Case field values keyed by storage key. Keys follow the `<field_name>_as_<storage_type>` convention (for example `priority_as_keyword`) and map to the owner's global (library-wide) fields plus, when a template is applied to the case, that template's fields. On update, the keys provided are merged into the stored map; unlisted keys are left untouched. To discover the writable keys, use the get case fields API (`GET /api/cases/fields`).\n"
      x-state: Technical preview; added in 9.5.0
    Cases_case_observable:
      title: Case observable
      required:
        - id
        - typeKey
        - value
        - description
        - createdAt
        - updatedAt
      type: object
      properties:
        createdAt:
          type: string
          description: When the observable was created.
          format: date-time
          example: '2024-11-14T10:00:00.000Z'
        description:
          type:
            - 'null'
            - string
          description: An optional description for the observable.
          example: Source IP
        id:
          type: string
          description: The observable identifier.
          example: df927ab8-54ed-47d6-be07-9948c255c097
        typeKey:
          type: string
          description: The observable type key.
          example: observable-type-ipv4
        updatedAt:
          type:
            - 'null'
            - string
          description: When the observable was last updated.
          format: date-time
          example: '2024-11-14T10:00:00.000Z'
        value:
          type: string
          description: The observable value.
          example: 10.0.0.8
      description: A single observable attached to a case.
    Cases_case_response_closed_by_properties:
      title: Case response properties for closed_by
      required:
        - email
        - full_name
        - username
      type:
        - 'null'
        - object
      properties:
        email:
          type:
            - 'null'
            - string
          example: 'null'
        full_name:
          type:
            - 'null'
            - string
          example: 'null'
        profile_uid:
          type: string
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
        username:
          type:
            - 'null'
            - string
          example: elastic
    Cases_case_response_created_by_properties:
      title: Case response properties for created_by
      required:
        - email
        - full_name
        - username
      type: object
      properties:
        email:
          type:
            - 'null'
            - string
          example: 'null'
        full_name:
          type:
            - 'null'
            - string
          example: 'null'
        profile_uid:
          type: string
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
        username:
          type:
            - 'null'
            - string
          example: elastic
    Cases_case_response_get_case:
      title: Get case response
      required:
        - closed_at
        - closed_by
        - connector
        - created_at
        - created_by
        - description
        - duration
        - external_service
        - id
        - observables
        - owner
        - settings
        - severity
        - status
        - tags
        - title
        - totalAlerts
        - totalComment
        - total_observables
        - updated_at
        - updated_by
        - version
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          type:
            - 'null'
            - string
          description: The case category.
        closed_at:
          type:
            - 'null'
            - string
          format: date-time
        closed_by:
          $ref: '#/components/schemas/Cases_case_response_closed_by_properties'
        connector:
          title: Case response properties for connectors
          oneOf:
            - $ref: '#/components/schemas/Cases_connector_properties_none'
            - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
            - $ref: '#/components/schemas/Cases_connector_properties_jira'
            - $ref: '#/components/schemas/Cases_connector_properties_resilient'
            - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
            - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
            - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
          discriminator:
            propertyName: type
            mapping:
              .cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
              .jira: '#/components/schemas/Cases_connector_properties_jira'
              .none: '#/components/schemas/Cases_connector_properties_none'
              .resilient: '#/components/schemas/Cases_connector_properties_resilient'
              .servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
              .servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
              .swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
        created_at:
          type: string
          format: date-time
          example: '2022-05-13T09:16:17.416Z'
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        customFields:
          type: array
          items:
            type: object
            properties:
              key:
                type: string
                description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
              type:
                enum:
                  - text
                  - toggle
                type: string
                description: "The custom field type. It must match the type specified in the case configuration settings.\n"
              value:
                oneOf:
                  - maxLength: 160
                    minLength: 1
                    type:
                      - 'null'
                      - string
                  - type: boolean
                description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
          description: Custom field values for the case.
        description:
          type: string
          example: A case description.
        duration:
          type:
            - 'null'
            - integer
          description: "The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.\n"
          example: 120
        external_service:
          $ref: '#/components/schemas/Cases_external_service'
        id:
          type: string
          example: 66b9aa00-94fa-11ea-9f74-e7e108796192
        incremental_id:
          type:
            - 'null'
            - integer
          description: "A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.\n"
          example: 1
        observables:
          type: array
          items:
            $ref: '#/components/schemas/Cases_case_observable'
          description: Observables attached to the case.
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          type: array
          items:
            type: string
          example:
            - tag-1
        title:
          type: string
          example: Case title 1
        total_observables:
          type:
            - 'null'
            - integer
          description: The number of observables attached to the case.
          example: 0
        totalAlerts:
          type: integer
          example: 0
        totalComment:
          type: integer
          description: The number of user comments on the case. Use the find case comments API to retrieve comment content.
          example: 1
        totalEvents:
          type: integer
          description: The number of events attached to the case.
          example: 0
        updated_at:
          type:
            - 'null'
            - string
          format: date-time
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          type: string
          example: WzUzMiwxXQ==
      description: "Case details returned by the get case API. The comments property is not included in the response. Use the find case comments API to retrieve comments. totalComment reflects the actual number of user comments.\n"
    Cases_case_response_properties:
      title: Case response properties
      required:
        - closed_at
        - closed_by
        - comments
        - connector
        - created_at
        - created_by
        - description
        - duration
        - external_service
        - id
        - observables
        - owner
        - settings
        - severity
        - status
        - tags
        - title
        - totalAlerts
        - totalComment
        - total_observables
        - updated_at
        - updated_by
        - version
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          type:
            - 'null'
            - string
          description: The case category.
        closed_at:
          type:
            - 'null'
            - string
          format: date-time
        closed_by:
          $ref: '#/components/schemas/Cases_case_response_closed_by_properties'
        comments:
          title: Case response properties for comments
          maxItems: 10000
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Cases_alert_comment_response_properties'
              - $ref: '#/components/schemas/Cases_event_comment_response_properties'
              - $ref: '#/components/schemas/Cases_user_comment_response_properties'
            discriminator:
              propertyName: type
              mapping:
                alert: '#/components/schemas/Cases_alert_comment_response_properties'
                event: '#/components/schemas/Cases_event_comment_response_properties'
                user: '#/components/schemas/Cases_user_comment_response_properties'
          description: An array of comment objects for the case.
        connector:
          title: Case response properties for connectors
          oneOf:
            - $ref: '#/components/schemas/Cases_connector_properties_none'
            - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
            - $ref: '#/components/schemas/Cases_connector_properties_jira'
            - $ref: '#/components/schemas/Cases_connector_properties_resilient'
            - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
            - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
            - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
          discriminator:
            propertyName: type
            mapping:
              .cases-webhook: '#/components/schemas/Cases_connector_properties_cases_webhook'
              .jira: '#/components/schemas/Cases_connector_properties_jira'
              .none: '#/components/schemas/Cases_connector_properties_none'
              .resilient: '#/components/schemas/Cases_connector_properties_resilient'
              .servicenow: '#/components/schemas/Cases_connector_properties_servicenow'
              .servicenow-sir: '#/components/schemas/Cases_connector_properties_servicenow_sir'
              .swimlane: '#/components/schemas/Cases_connector_properties_swimlane'
        created_at:
          type: string
          format: date-time
          example: '2022-05-13T09:16:17.416Z'
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        customFields:
          type: array
          items:
            type: object
            properties:
              key:
                type: string
                description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
              type:
                enum:
                  - text
                  - toggle
                type: string
                description: "The custom field type. It must match the type specified in the case configuration settings.\n"
              value:
                oneOf:
                  - maxLength: 160
                    minLength: 1
                    type:
                      - 'null'
                      - string
                  - type: boolean
                description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
          description: Custom field values for the case.
        description:
          type: string
          example: A case description.
        duration:
          type:
            - 'null'
            - integer
          description: "The elapsed time from the creation of the case to its closure (in seconds). If the case has not been closed, the duration is set to null. If the case was closed after less than half a second, the duration is rounded down to zero.\n"
          example: 120
        extended_fields:
          type: object
          additionalProperties:
            type: string
          description: "The case's stored field values, keyed by storage key (for example `priority_as_keyword`).\n"
          x-state: Technical preview; added in 9.5.0
        external_service:
          $ref: '#/components/schemas/Cases_external_service'
        id:
          type: string
          example: 66b9aa00-94fa-11ea-9f74-e7e108796192
        incremental_id:
          type:
            - 'null'
            - integer
          description: "A monotonically increasing number assigned to each case, unique per space. This value is generated asynchronously after the case is created and may not be present immediately in the response.\n"
          example: 1
        observables:
          type: array
          items:
            $ref: '#/components/schemas/Cases_case_observable'
          description: Observables attached to the case.
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          type: array
          items:
            type: string
          example:
            - tag-1
        title:
          type: string
          example: Case title 1
        total_observables:
          type:
            - 'null'
            - integer
          description: The number of observables attached to the case.
          example: 0
        totalAlerts:
          type: integer
          example: 0
        totalComment:
          type: integer
          example: 0
        totalEvents:
          type: integer
          description: The number of events attached to the case.
          example: 0
        updated_at:
          type:
            - 'null'
            - string
          format: date-time
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          type: string
          example: WzUzMiwxXQ==
    Cases_case_response_pushed_by_properties:
      title: Case response properties for pushed_by
      required:
        - email
        - full_name
        - username
      type:
        - 'null'
        - object
      properties:
        email:
          type:
            - 'null'
            - string
          example: 'null'
        full_name:
          type:
            - 'null'
            - string
          example: 'null'
        profile_uid:
          type: string
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
        username:
          type:
            - 'null'
            - string
          example: elastic
    Cases_case_response_updated_by_properties:
      title: Case response properties for updated_by
      required:
        - email
        - full_name
        - username
      type:
        - 'null'
        - object
      properties:
        email:
          type:
            - 'null'
            - string
          example: 'null'
        full_name:
          type:
            - 'null'
            - string
          example: 'null'
        profile_uid:
          type: string
          example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
        username:
          type:
            - 'null'
            - string
          example: elastic
    Cases_case_severity:
      enum:
        - critical
        - high
        - low
        - medium
      type: string
      description: The severity of the case.
    Cases_case_status:
      enum:
        - closed
        - in-progress
        - open
      type: string
      description: The status of the case.
    Cases_case_tags:
      maxItems: 200
      type: array
      items:
        maxLength: 256
        type: string
      description: "The words and phrases that help categorize cases. It can be an empty array.\n"
    Cases_case_title:
      maxLength: 160
      type: string
      description: A title for the case.
    Cases_closure_types:
      enum:
        - close-by-pushing
        - close-by-user
      type: string
      description: Indicates whether a case is automatically closed when it is pushed to external systems (`close-by-pushing`) or not automatically closed (`close-by-user`).
      example: close-by-user
    Cases_connector_properties_cases_webhook:
      title: Create or upate case request properties for Cases Webhook connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          type:
            - 'null'
            - string
          example: 'null'
        id:
          type: string
          description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
        name:
          type: string
          description: The name of the connector.
        type:
          enum:
            - .cases-webhook
          type: string
          description: The type of connector.
          example: .cases-webhook
      description: Defines properties for connectors when type is `.cases-webhook`.
    Cases_connector_properties_jira:
      title: Create or update case request properties for a Jira connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          required:
            - issueType
            - parent
            - priority
          type: object
          properties:
            issueType:
              type:
                - 'null'
                - string
              description: The type of issue.
            parent:
              type:
                - 'null'
                - string
              description: 'The key of the parent issue, when the issue type is sub-task.'
            priority:
              type:
                - 'null'
                - string
              description: The priority of the issue.
          description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
        id:
          type: string
          description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
        name:
          type: string
          description: The name of the connector.
        type:
          enum:
            - .jira
          type: string
          description: The type of connector.
          example: .jira
      description: Defines properties for connectors when type is `.jira`.
    Cases_connector_properties_none:
      title: Create or update case request properties for no connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          type:
            - 'null'
            - string
          description: 'An object containing the connector fields. To create a case without a connector, specify null. To update a case to remove the connector, specify null.'
          example: 'null'
        id:
          type: string
          description: 'The identifier for the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.'
          example: none
        name:
          type: string
          description: 'The name of the connector. To create a case without a connector, use `none`. To update a case to remove the connector, specify `none`.'
          example: none
        type:
          enum:
            - .none
          type: string
          description: 'The type of connector. To create a case without a connector, use `.none`. To update a case to remove the connector, specify `.none`.'
          example: .none
      description: Defines properties for connectors when type is `.none`.
    Cases_connector_properties_resilient:
      title: Create case request properties for a IBM Resilient connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          required:
            - issueTypes
            - severityCode
          type:
            - 'null'
            - object
          properties:
            issueTypes:
              type: array
              items:
                type: string
              description: The type of incident.
            severityCode:
              type: string
              description: The severity code of the incident.
          description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
        id:
          type: string
          description: The identifier for the connector.
        name:
          type: string
          description: The name of the connector.
        type:
          enum:
            - .resilient
          type: string
          description: The type of connector.
          example: .resilient
      description: Defines properties for connectors when type is `.resilient`.
    Cases_connector_properties_servicenow:
      title: Create case request properties for a ServiceNow ITSM connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          required:
            - category
            - impact
            - severity
            - subcategory
            - urgency
          type: object
          properties:
            category:
              type:
                - 'null'
                - string
              description: The category of the incident.
            impact:
              type:
                - 'null'
                - string
              description: The effect an incident had on business.
            severity:
              type:
                - 'null'
                - string
              description: The severity of the incident.
            subcategory:
              type:
                - 'null'
                - string
              description: The subcategory of the incident.
            urgency:
              type:
                - 'null'
                - string
              description: The extent to which the incident resolution can be delayed.
          description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
        id:
          type: string
          description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
        name:
          type: string
          description: The name of the connector.
        type:
          enum:
            - .servicenow
          type: string
          description: The type of connector.
          example: .servicenow
      description: Defines properties for connectors when type is `.servicenow`.
    Cases_connector_properties_servicenow_sir:
      title: Create case request properties for a ServiceNow SecOps connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          required:
            - category
            - destIp
            - malwareHash
            - malwareUrl
            - priority
            - sourceIp
            - subcategory
          type: object
          properties:
            category:
              type:
                - 'null'
                - string
              description: The category of the incident.
            destIp:
              type:
                - 'null'
                - boolean
              description: Indicates whether cases will send a comma-separated list of destination IPs.
            malwareHash:
              type:
                - 'null'
                - boolean
              description: Indicates whether cases will send a comma-separated list of malware hashes.
            malwareUrl:
              type:
                - 'null'
                - boolean
              description: Indicates whether cases will send a comma-separated list of malware URLs.
            priority:
              type:
                - 'null'
                - string
              description: The priority of the issue.
            sourceIp:
              type:
                - 'null'
                - boolean
              description: Indicates whether cases will send a comma-separated list of source IPs.
            subcategory:
              type:
                - 'null'
                - string
              description: The subcategory of the incident.
          description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
        id:
          type: string
          description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
        name:
          type: string
          description: The name of the connector.
        type:
          enum:
            - .servicenow-sir
          type: string
          description: The type of connector.
          example: .servicenow-sir
      description: Defines properties for connectors when type is `.servicenow-sir`.
    Cases_connector_properties_swimlane:
      title: Create case request properties for a Swimlane connector
      required:
        - fields
        - id
        - name
        - type
      type: object
      properties:
        fields:
          required:
            - caseId
          type: object
          properties:
            caseId:
              type:
                - 'null'
                - string
              description: The case identifier for Swimlane connectors.
          description: 'An object containing the connector fields. If you want to omit any individual field, specify null as its value.'
        id:
          type: string
          description: 'The identifier for the connector. To retrieve connector IDs, use the find connectors API.'
        name:
          type: string
          description: The name of the connector.
        type:
          enum:
            - .swimlane
          type: string
          description: The type of connector.
          example: .swimlane
      description: Defines properties for connectors when type is `.swimlane`.
    Cases_connector_types:
      enum:
        - .cases-webhook
        - .jira
        - .none
        - .resilient
        - .servicenow
        - .servicenow-sir
        - .swimlane
      type: string
      description: The type of connector.
      example: .none
    Cases_create_case_request:
      title: Create case request
      required:
        - connector
        - description
        - owner
        - settings
        - tags
        - title
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        category:
          $ref: '#/components/schemas/Cases_case_category'
        connector:
          oneOf:
            - $ref: '#/components/schemas/Cases_connector_properties_none'
            - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
            - $ref: '#/components/schemas/Cases_connector_properties_jira'
            - $ref: '#/components/schemas/Cases_connector_properties_resilient'
            - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
            - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
            - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
        customFields:
          maxItems: 10
          minItems: 0
          type: array
          items:
            required:
              - key
              - type
              - value
            type: object
            properties:
              key:
                type: string
                description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
              type:
                enum:
                  - text
                  - toggle
                type: string
                description: "The custom field type. It must match the type specified in the case configuration settings.\n"
              value:
                oneOf:
                  - maxLength: 160
                    minLength: 1
                    type:
                      - 'null'
                      - string
                  - type: boolean
                description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
          description: "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n"
        description:
          $ref: '#/components/schemas/Cases_case_description'
        extended_fields:
          $ref: '#/components/schemas/Cases_case_extended_fields'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        tags:
          $ref: '#/components/schemas/Cases_case_tags'
        template:
          required:
            - id
          type:
            - 'null'
            - object
          properties:
            id:
              type: string
              description: The template identifier. Retrieve template ids with `GET /api/cases/templates`.
            version:
              minimum: 1
              type: integer
              description: "The template version to apply. Omit to use (and pin) the latest version.\n"
          description: "A case template to create the case from. Requires the `xpack.cases.templates.enabled` setting. The server applies the template's case defaults (severity, category, tags, assignees, settings, connector) and its field defaults into `extended_fields`; any value explicitly provided in the request wins over the template default. When `version` is omitted, the latest version of the template is resolved and pinned on the case. To discover a template's fields before creating a case, use the get case fields API (`GET /api/cases/fields`).\n"
          x-state: Technical preview
        title:
          $ref: '#/components/schemas/Cases_case_title'
      description: The create case API request body varies depending on the type of connector.
    Cases_event_comment_response_properties:
      title: Case response properties for event comments
      required:
        - type
      type: object
      properties:
        created_at:
          type: string
          format: date-time
          example: '2022-05-13T09:16:17.416Z'
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        eventId:
          type: array
          items:
            type: string
            example: 7605e6a6f9f4f990ad9f8f6901e5f082f1f1f1665cbaf2f0f2c6f8f6b0d8a39f
        id:
          type: string
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        index:
          type: array
          items:
            type: string
            example: .internal.alerts-security.alerts-default-000001
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          type:
            - 'null'
            - string
          format: date-time
          example: 'null'
        pushed_by:
          $ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
        type:
          enum:
            - event
          type: string
          example: event
        updated_at:
          type:
            - 'null'
            - string
          format: date-time
          example: 'null'
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          type: string
          example: WzIwNDMxLDFd
    Cases_external_service:
      type:
        - 'null'
        - object
      properties:
        connector_id:
          type: string
        connector_name:
          type: string
        external_id:
          type: string
        external_title:
          type: string
        external_url:
          type: string
        pushed_at:
          type: string
          format: date-time
        pushed_by:
          type:
            - 'null'
            - object
          properties:
            email:
              type:
                - 'null'
                - string
              example: 'null'
            full_name:
              type:
                - 'null'
                - string
              example: 'null'
            profile_uid:
              type: string
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
            username:
              type:
                - 'null'
                - string
              example: elastic
    Cases_find_comments_response:
      title: Find case comments response
      required:
        - comments
        - page
        - per_page
        - total
      type: object
      properties:
        comments:
          type: array
          items:
            $ref: '#/components/schemas/Cases_user_comment_response_properties'
          description: Paginated list of user comments for the case.
        page:
          type: integer
          description: The current page index.
        per_page:
          type: integer
          description: The number of items per page.
        total:
          type: integer
          description: The total number of comments.
    Cases_get_case_templates_response:
      required:
        - templates
        - page
        - perPage
        - total
      type: object
      properties:
        page:
          type: integer
          description: The page number of the returned results.
        perPage:
          type: integer
          description: The number of results per page.
        templates:
          type: array
          items:
            allOf:
              - $ref: '#/components/schemas/Cases_template_v2_response'
              - required:
                  - fieldSearchMatches
                type: object
                properties:
                  fieldSearchMatches:
                    type: boolean
                    description: Whether the search query matched a field name in this template.
        total:
          type: integer
          description: The total number of templates matching the query.
      description: Response returned by the get all case templates API.
    Cases_owner:
      enum:
        - cases
        - observability
        - securitySolution
      type: string
      description: "The application that owns the cases: Stack Management, Observability, or Elastic Security.\n"
      example: cases
    Cases_owners:
      type: array
      items:
        $ref: '#/components/schemas/Cases_owner'
    Cases_payload_alert_comment:
      type: object
      properties:
        comment:
          type: object
          properties:
            alertId:
              oneOf:
                - type: string
                  example: 1c0b056b-cc9f-4b61-b5c9-cb801abd5e1d
                - type: array
                  items:
                    type: string
            index:
              oneOf:
                - type: string
                  example: .alerts-observability.logs.alerts-default
                - type: array
                  items:
                    type: string
            owner:
              $ref: '#/components/schemas/Cases_owner'
            rule:
              type: object
              properties:
                id:
                  type:
                    - 'null'
                    - string
                  description: The rule identifier.
                  example: 94d80550-aaf4-11ec-985f-97e55adae8b9
                name:
                  type:
                    - 'null'
                    - string
                  description: The rule name.
                  example: security_rule
            type:
              enum:
                - alert
              type: string
    Cases_payload_assignees:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
    Cases_payload_connector:
      type: object
      properties:
        connector:
          type: object
          properties:
            fields:
              type:
                - 'null'
                - object
              properties:
                caseId:
                  type: string
                  description: The case identifier for Swimlane connectors.
                category:
                  type: string
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                destIp:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
                impact:
                  type: string
                  description: The effect an incident had on business for ServiceNow ITSM connectors.
                issueType:
                  type: string
                  description: The type of issue for Jira connectors.
                issueTypes:
                  type: array
                  items:
                    type: string
                  description: The type of incident for IBM Resilient connectors.
                malwareHash:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
                malwareUrl:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
                parent:
                  type: string
                  description: 'The key of the parent issue, when the issue type is sub-task for Jira connectors.'
                priority:
                  type: string
                  description: The priority of the issue for Jira and ServiceNow SecOps connectors.
                severity:
                  type: string
                  description: The severity of the incident for ServiceNow ITSM connectors.
                severityCode:
                  type: string
                  description: The severity code of the incident for IBM Resilient connectors.
                sourceIp:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
                subcategory:
                  type: string
                  description: The subcategory of the incident for ServiceNow ITSM connectors.
                urgency:
                  type: string
                  description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
              description: 'An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.'
              example: 'null'
            id:
              type: string
              description: 'The identifier for the connector. To create a case without a connector, use `none`.'
              example: none
            name:
              type: string
              description: 'The name of the connector. To create a case without a connector, use `none`.'
              example: none
            type:
              $ref: '#/components/schemas/Cases_connector_types'
    Cases_payload_create_case:
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Cases_assignees'
        connector:
          type: object
          properties:
            fields:
              type:
                - 'null'
                - object
              properties:
                caseId:
                  type: string
                  description: The case identifier for Swimlane connectors.
                category:
                  type: string
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                destIp:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of destination IPs for ServiceNow SecOps connectors.
                impact:
                  type: string
                  description: The effect an incident had on business for ServiceNow ITSM connectors.
                issueType:
                  type: string
                  description: The type of issue for Jira connectors.
                issueTypes:
                  type: array
                  items:
                    type: string
                  description: The type of incident for IBM Resilient connectors.
                malwareHash:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of malware hashes for ServiceNow SecOps connectors.
                malwareUrl:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of malware URLs for ServiceNow SecOps connectors.
                parent:
                  type: string
                  description: 'The key of the parent issue, when the issue type is sub-task for Jira connectors.'
                priority:
                  type: string
                  description: The priority of the issue for Jira and ServiceNow SecOps connectors.
                severity:
                  type: string
                  description: The severity of the incident for ServiceNow ITSM connectors.
                severityCode:
                  type: string
                  description: The severity code of the incident for IBM Resilient connectors.
                sourceIp:
                  type:
                    - 'null'
                    - boolean
                  description: Indicates whether cases will send a comma-separated list of source IPs for ServiceNow SecOps connectors.
                subcategory:
                  type: string
                  description: The subcategory of the incident for ServiceNow ITSM connectors.
                urgency:
                  type: string
                  description: The extent to which the incident resolution can be delayed for ServiceNow ITSM connectors.
              description: 'An object containing the connector fields. To create a case without a connector, specify null. If you want to omit any individual field, specify null as its value.'
              example: 'null'
            id:
              type: string
              description: 'The identifier for the connector. To create a case without a connector, use `none`.'
              example: none
            name:
              type: string
              description: 'The name of the connector. To create a case without a connector, use `none`.'
              example: none
            type:
              $ref: '#/components/schemas/Cases_connector_types'
        description:
          type: string
        owner:
          $ref: '#/components/schemas/Cases_owner'
        settings:
          $ref: '#/components/schemas/Cases_settings'
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
        status:
          $ref: '#/components/schemas/Cases_case_status'
        tags:
          type: array
          items:
            type: string
          example:
            - tag-1
        title:
          type: string
    Cases_payload_delete:
      type:
        - 'null'
        - object
      description: 'If the `action` is `delete` and the `type` is `delete_case`, the payload is nullable.'
    Cases_payload_description:
      type: object
      properties:
        description:
          type: string
    Cases_payload_pushed:
      type: object
      properties:
        externalService:
          $ref: '#/components/schemas/Cases_external_service'
    Cases_payload_settings:
      type: object
      properties:
        settings:
          $ref: '#/components/schemas/Cases_settings'
    Cases_payload_severity:
      type: object
      properties:
        severity:
          $ref: '#/components/schemas/Cases_case_severity'
    Cases_payload_status:
      type: object
      properties:
        status:
          $ref: '#/components/schemas/Cases_case_status'
    Cases_payload_tags:
      type: object
      properties:
        tags:
          type: array
          items:
            type: string
          example:
            - tag-1
    Cases_payload_title:
      type: object
      properties:
        title:
          type: string
    Cases_payload_user_comment:
      type: object
      properties:
        comment:
          type: object
          properties:
            comment:
              type: string
            owner:
              $ref: '#/components/schemas/Cases_owner'
            type:
              enum:
                - user
              type: string
    Cases_related_case:
      title: Related case
      required:
        - id
        - title
        - description
        - status
        - createdAt
        - totals
      type: object
      properties:
        createdAt:
          type: string
          description: When the case was created.
          format: date-time
        description:
          type: string
          description: The case description.
        id:
          type: string
          description: The case identifier.
        status:
          $ref: '#/components/schemas/Cases_case_status'
        title:
          type: string
          description: The case title.
        totals:
          $ref: '#/components/schemas/Cases_attachment_totals'
      description: "Summary of a case returned when listing cases that contain a given alert. This is a subset of the full case response.\n"
    Cases_response_4xx:
      title: Unsuccessful cases API response
      type: object
      properties:
        error:
          type: string
          example: Unauthorized
        message:
          type: string
        statusCode:
          type: integer
          example: 401
    Cases_rule:
      title: Alerting rule
      type: object
      properties:
        id:
          type: string
          description: The rule identifier.
          example: 94d80550-aaf4-11ec-985f-97e55adae8b9
        name:
          type: string
          description: The rule name.
          example: security_rule
      description: "The rule that is associated with the alerts. It is required only when `type` is `alert`. This functionality is in technical preview and may be changed or removed in a future release. Elastic will work to fix any issues, but features in technical preview are not subject to the support SLA of official GA features.\n"
      x-state: Technical preview
    Cases_searchFieldsType:
      enum:
        - description
        - title
      type: string
      description: The fields to perform the `simple_query_string` parsed query against.
    Cases_searchFieldsTypeArray:
      type: array
      items:
        $ref: '#/components/schemas/Cases_searchFieldsType'
    Cases_set_case_configuration_request:
      title: Set case configuration request
      required:
        - closure_type
        - connector
        - owner
      type: object
      properties:
        closure_type:
          $ref: '#/components/schemas/Cases_closure_types'
        connector:
          required:
            - fields
            - id
            - name
            - type
          type: object
          properties:
            fields:
              type:
                - 'null'
                - object
              description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
            id:
              type: string
              description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
              example: none
            name:
              type: string
              description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
              example: none
            type:
              $ref: '#/components/schemas/Cases_connector_types'
          description: An object that contains the connector configuration.
        customFields:
          maxItems: 10
          minItems: 0
          type: array
          items:
            required:
              - key
              - label
              - required
              - type
            type: object
            properties:
              defaultValue:
                type:
                  - boolean
                  - string
                description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
              key:
                maxLength: 36
                minLength: 1
                type: string
                description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
              label:
                maxLength: 50
                minLength: 1
                type: string
                description: The custom field label that is displayed in the case.
              type:
                enum:
                  - text
                  - toggle
                type: string
                description: The type of the custom field.
              required:
                type: boolean
                description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
          description: Custom fields case configuration.
        owner:
          $ref: '#/components/schemas/Cases_owner'
        templates:
          $ref: '#/components/schemas/Cases_templates'
      description: 'External connection details, such as the closure type and default connector for cases.'
    Cases_settings:
      required:
        - syncAlerts
      type: object
      properties:
        extractObservables:
          type: boolean
          description: "When true, observables (e.g. IPs, hashes, URLs) are automatically extracted from case comments. Optional; defaults to false when omitted.\n"
          example: false
        syncAlerts:
          type: boolean
          description: Turns alert syncing on or off.
          example: true
      description: An object that contains the case settings.
    Cases_string:
      type: string
    Cases_string_array:
      maxItems: 100
      type: array
      items:
        $ref: '#/components/schemas/Cases_string'
    Cases_template_dry_run_response:
      title: Template write dry run response
      required:
        - valid
      type: object
      properties:
        valid:
          enum:
            - true
          type: boolean
          description: Always `true` — validation failures return a 4xx error instead.
      description: Returned instead of the template when the request was sent with `dry_run=true`.
    Cases_template_tags:
      maxItems: 200
      type: array
      items:
        maxLength: 256
        type: string
      description: "The words and phrases that help categorize templates. It can be an empty array.\n"
    Cases_template_v2_response:
      required:
        - templateId
        - name
        - owner
        - definition
        - definitionString
        - templateVersion
        - deletedAt
        - isLatest
        - latestVersion
      type: object
      properties:
        author:
          maxLength: 1000
          type: string
          description: The username of the template author.
        definition:
          description: The parsed template definition.
        definitionString:
          maxLength: 30000
          type: string
          description: The raw YAML definition string.
        deletedAt:
          type:
            - 'null'
            - string
          description: 'The date the template was soft-deleted, or null if active.'
          format: date-time
        description:
          maxLength: 30000
          type: string
          description: A human-readable description of the template.
        fieldCount:
          type: integer
          description: The number of fields defined in the template.
        fieldDefinitions:
          type: array
          items:
            required:
              - name
              - label
              - type
              - control
            type: object
            properties:
              control:
                maxLength: 50
                type: string
              label:
                maxLength: 256
                type: string
              name:
                maxLength: 256
                type: string
              type:
                maxLength: 50
                type: string
          description: Metadata about each field defined in the template.
        isDefault:
          type: boolean
          description: Whether this is the default template for its owner.
        isEnabled:
          type: boolean
          description: Whether the template is enabled.
        isLatest:
          type: boolean
          description: Whether this is the latest version of the template.
        lastUsedAt:
          type: string
          description: The date the template was last used to create a case.
          format: date-time
        latestVersion:
          type: integer
          description: The latest version number of this template.
        name:
          maxLength: 100
          type: string
          description: The display name of the template.
        owner:
          maxLength: 50
          type: string
          description: 'The owning solution (e.g. cases, observability, securitySolution).'
        tags:
          $ref: '#/components/schemas/Cases_template_tags'
        templateId:
          maxLength: 36
          type: string
          description: 'The unique identifier of the template, shared across all versions.'
        templateVersion:
          type: integer
          description: The version number of this template revision.
        usageCount:
          type: integer
          description: The number of times this template has been used to create a case.
      description: A case template (v2).
    Cases_template_write_request:
      title: Template write request
      required:
        - owner
        - definition
      type: object
      properties:
        definition:
          maxLength: 30000
          type: string
          description: "The template definition as a YAML string: case defaults (name, severity, category, tags, assignees, connector, settings) and a `fields` array of inline field definitions or `$ref` entries pointing into the owner's field library. Stored field values appear on cases under `extended_fields` keys shaped `<field_name>_as_<storage_type>`.\n"
          example: "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n  - $ref: risk_score\n"
        description:
          maxLength: 1000
          type: string
          description: A description of the template.
        isEnabled:
          type: boolean
          description: Disabled templates are hidden from the case creation flow.
          default: true
        name:
          maxLength: 50
          minLength: 1
          type: string
          description: "The template identity name, unique per owner (case-insensitive). May be omitted when the YAML definition provides a case-default title (`name:`), which is then used as the identity name.\n"
        owner:
          $ref: '#/components/schemas/Cases_owner'
        tags:
          $ref: '#/components/schemas/Cases_template_tags'
      description: "The body for creating or fully replacing a case template. Server-managed attributes (author, usage statistics, field summaries, version flags) are computed and cannot be set.\n\nResource limits (enforced on write; a violation returns `400`): an owner may have at most 200 templates per space, and a definition may declare at most 200 fields. Version history is intentionally uncapped. A single stored extended-field value may not exceed 30000 UTF-8 bytes. The YAML `definition` string itself may not exceed 30000 characters (enforced on create, update, and `dry_run`).\n"
    Cases_templates:
      type: array
      items:
        type: object
        properties:
          caseFields:
            type: object
            properties:
              assignees:
                $ref: '#/components/schemas/Cases_assignees'
              category:
                $ref: '#/components/schemas/Cases_case_category'
              connector:
                type: object
                properties:
                  fields:
                    type:
                      - 'null'
                      - object
                    description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
                  id:
                    type: string
                    description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
                    example: none
                  name:
                    type: string
                    description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
                    example: none
                  type:
                    $ref: '#/components/schemas/Cases_connector_types'
              customFields:
                type: array
                items:
                  type: object
                  properties:
                    key:
                      type: string
                      description: The unique key for the custom field.
                    type:
                      enum:
                        - text
                        - toggle
                      type: string
                      description: The type of the custom field.
                    value:
                      type:
                        - boolean
                        - string
                      description: "The default value for the custom field when a case uses the template. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
                description: Custom field values in the template.
                x-state: Technical preview
              description:
                $ref: '#/components/schemas/Cases_case_description'
              settings:
                $ref: '#/components/schemas/Cases_settings'
              severity:
                $ref: '#/components/schemas/Cases_case_severity'
              tags:
                $ref: '#/components/schemas/Cases_case_tags'
              title:
                $ref: '#/components/schemas/Cases_case_title'
          description:
            type: string
            description: A description for the template.
          key:
            type: string
            description: "A unique key for the template. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific template.\n"
          name:
            type: string
            description: The name of the template.
          tags:
            $ref: '#/components/schemas/Cases_template_tags'
      x-state: Technical preview
    Cases_update_alert_comment_request_properties:
      title: Update case comment request properties for alerts
      required:
        - alertId
        - id
        - index
        - owner
        - rule
        - type
        - version
      type: object
      properties:
        alertId:
          $ref: '#/components/schemas/Cases_alert_identifiers'
        id:
          type: string
          description: "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n"
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        index:
          $ref: '#/components/schemas/Cases_alert_indices'
        owner:
          $ref: '#/components/schemas/Cases_owner'
        rule:
          $ref: '#/components/schemas/Cases_rule'
        type:
          enum:
            - alert
          type: string
          description: The type of comment.
          example: alert
        version:
          type: string
          description: "The current comment version. To retrieve version values, use the get comments API.\n"
          example: Wzk1LDFd
      description: Defines properties for case comment requests when type is alert.
    Cases_update_case_comment_request:
      title: Update case comment request
      oneOf:
        - $ref: '#/components/schemas/Cases_update_alert_comment_request_properties'
        - $ref: '#/components/schemas/Cases_update_user_comment_request_properties'
      description: The update case comment API request body varies depending on whether you are updating an alert or a comment.
      discriminator:
        propertyName: type
        mapping:
          alert: '#/components/schemas/Cases_update_alert_comment_request_properties'
          user: '#/components/schemas/Cases_update_user_comment_request_properties'
    Cases_update_case_configuration_request:
      title: Update case configuration request
      required:
        - version
      type: object
      properties:
        closure_type:
          $ref: '#/components/schemas/Cases_closure_types'
        connector:
          required:
            - fields
            - id
            - name
            - type
          type: object
          properties:
            fields:
              type:
                - 'null'
                - object
              description: 'The fields specified in the case configuration are not used and are not propagated to individual cases, therefore it is recommended to set it to `null`.'
            id:
              type: string
              description: 'The identifier for the connector. If you do not want a default connector, use `none`. To retrieve connector IDs, use the find connectors API.'
              example: none
            name:
              type: string
              description: 'The name of the connector. If you do not want a default connector, use `none`. To retrieve connector names, use the find connectors API.'
              example: none
            type:
              $ref: '#/components/schemas/Cases_connector_types'
          description: An object that contains the connector configuration.
        customFields:
          type: array
          items:
            required:
              - key
              - label
              - required
              - type
            type: object
            properties:
              defaultValue:
                type:
                  - boolean
                  - string
                description: "A default value for the custom field. If the `type` is `text`, the default value must be a string. If the `type` is `toggle`, the default value must be boolean.\n"
              key:
                maxLength: 36
                minLength: 1
                type: string
                description: "A unique key for the custom field. Must be lower case and composed only of a-z, 0-9, '_', and '-' characters. It is used in API calls to refer to a specific custom field.\n"
              label:
                maxLength: 50
                minLength: 1
                type: string
                description: The custom field label that is displayed in the case.
              type:
                enum:
                  - text
                  - toggle
                type: string
                description: The type of the custom field.
              required:
                type: boolean
                description: "Indicates whether the field is required. If `false`, the custom field can be set to null or omitted when a case is created or updated.\n"
          description: Custom fields case configuration.
        templates:
          $ref: '#/components/schemas/Cases_templates'
        version:
          type: string
          description: "The version of the connector. To retrieve the version value, use the get configuration API.\n"
          example: WzIwMiwxXQ==
      description: "You can update settings such as the closure type, custom fields, templates, and the default connector for cases.\n"
    Cases_update_case_request:
      title: Update case request
      required:
        - cases
      type: object
      properties:
        cases:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - id
              - version
            type: object
            properties:
              assignees:
                $ref: '#/components/schemas/Cases_assignees'
              category:
                $ref: '#/components/schemas/Cases_case_category'
              closeReason:
                $ref: '#/components/schemas/Cases_case_close_sync_reason'
              connector:
                oneOf:
                  - $ref: '#/components/schemas/Cases_connector_properties_none'
                  - $ref: '#/components/schemas/Cases_connector_properties_cases_webhook'
                  - $ref: '#/components/schemas/Cases_connector_properties_jira'
                  - $ref: '#/components/schemas/Cases_connector_properties_resilient'
                  - $ref: '#/components/schemas/Cases_connector_properties_servicenow'
                  - $ref: '#/components/schemas/Cases_connector_properties_servicenow_sir'
                  - $ref: '#/components/schemas/Cases_connector_properties_swimlane'
              customFields:
                maxItems: 10
                minItems: 0
                type: array
                items:
                  required:
                    - key
                    - type
                    - value
                  type: object
                  properties:
                    key:
                      type: string
                      description: "The unique identifier for the custom field. The key value must exist in the case configuration settings.\n"
                    type:
                      enum:
                        - text
                        - toggle
                      type: string
                      description: "The custom field type. It must match the type specified in the case configuration settings.\n"
                    value:
                      oneOf:
                        - maxLength: 160
                          minLength: 1
                          type:
                            - 'null'
                            - string
                        - type: boolean
                      description: "The custom field value. If the custom field is required, it cannot be explicitly set to null. However, for cases that existed when the required custom field was added, the default value stored in Elasticsearch is `undefined`. The value returned in the API and user interface in this case is `null`.\n"
                description: "Custom field values for a case. Any optional custom fields that are not specified in the request are set to null.\n"
              description:
                $ref: '#/components/schemas/Cases_case_description'
              extended_fields:
                $ref: '#/components/schemas/Cases_case_extended_fields'
              id:
                maxLength: 30000
                type: string
                description: The identifier for the case.
              settings:
                $ref: '#/components/schemas/Cases_settings'
              severity:
                $ref: '#/components/schemas/Cases_case_severity'
              status:
                $ref: '#/components/schemas/Cases_case_status'
              tags:
                $ref: '#/components/schemas/Cases_case_tags'
              title:
                $ref: '#/components/schemas/Cases_case_title'
              version:
                type: string
                description: "The current version of the case. To determine this value, use the get case or search cases (`_find`) APIs.\n"
          description: An array containing one or more case objects.
      description: The update case API request body varies depending on the type of connector.
    Cases_update_user_comment_request_properties:
      title: Update case comment request properties for user comments
      required:
        - comment
        - id
        - owner
        - type
        - version
      type: object
      properties:
        comment:
          maxLength: 30000
          type: string
          description: The new comment. It is required only when `type` is `user`.
          example: A new comment.
        id:
          type: string
          description: "The identifier for the comment. To retrieve comment IDs, use the get comments API.\n"
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        owner:
          $ref: '#/components/schemas/Cases_owner'
        type:
          enum:
            - user
          type: string
          description: The type of comment.
          example: user
        version:
          type: string
          description: "The current comment version. To retrieve version values, use the get comments API.\n"
          example: Wzk1LDFd
      description: Defines properties for case comment requests when type is user.
    Cases_user_actions_find_response_properties:
      required:
        - action
        - comment_id
        - created_at
        - created_by
        - id
        - owner
        - payload
        - type
        - version
      type: object
      properties:
        action:
          $ref: '#/components/schemas/Cases_actions'
        comment_id:
          type:
            - 'null'
            - string
          example: 578608d0-03b1-11ed-920c-974bfa104448
        created_at:
          type: string
          format: date-time
          example: '2022-05-13T09:16:17.416Z'
        created_by:
          required:
            - email
            - full_name
            - username
          type: object
          properties:
            email:
              type:
                - 'null'
                - string
              example: 'null'
            full_name:
              type:
                - 'null'
                - string
              example: 'null'
            profile_uid:
              type: string
              example: u_J41Oh6L9ki-Vo2tOogS8WRTENzhHurGtRc87NgEAlkc_0
            username:
              type:
                - 'null'
                - string
              example: elastic
        id:
          type: string
          example: 22fd3e30-03b1-11ed-920c-974bfa104448
        owner:
          $ref: '#/components/schemas/Cases_owner'
        payload:
          oneOf:
            - $ref: '#/components/schemas/Cases_payload_alert_comment'
            - $ref: '#/components/schemas/Cases_payload_assignees'
            - $ref: '#/components/schemas/Cases_payload_connector'
            - $ref: '#/components/schemas/Cases_payload_create_case'
            - $ref: '#/components/schemas/Cases_payload_delete'
            - $ref: '#/components/schemas/Cases_payload_description'
            - $ref: '#/components/schemas/Cases_payload_pushed'
            - $ref: '#/components/schemas/Cases_payload_settings'
            - $ref: '#/components/schemas/Cases_payload_severity'
            - $ref: '#/components/schemas/Cases_payload_status'
            - $ref: '#/components/schemas/Cases_payload_tags'
            - $ref: '#/components/schemas/Cases_payload_title'
            - $ref: '#/components/schemas/Cases_payload_user_comment'
        type:
          enum:
            - assignees
            - category
            - comment
            - connector
            - create_case
            - customFields
            - delete_case
            - description
            - extended_fields
            - observables
            - pushed
            - settings
            - severity
            - status
            - tags
            - title
          type: string
          description: The type of action.
          example: create_case
        version:
          type: string
          example: WzM1ODg4LDFd
    Cases_user_comment_response_properties:
      title: Case response properties for user comments
      required:
        - type
      type: object
      properties:
        comment:
          type: string
          example: A new comment.
        created_at:
          type: string
          format: date-time
          example: '2022-05-13T09:16:17.416Z'
        created_by:
          $ref: '#/components/schemas/Cases_case_response_created_by_properties'
        id:
          type: string
          example: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        owner:
          $ref: '#/components/schemas/Cases_owner'
        pushed_at:
          type:
            - 'null'
            - string
          format: date-time
          example: 'null'
        pushed_by:
          $ref: '#/components/schemas/Cases_case_response_pushed_by_properties'
        type:
          enum:
            - user
          type: string
          example: user
        updated_at:
          type:
            - 'null'
            - string
          format: date-time
          example: 'null'
        updated_by:
          $ref: '#/components/schemas/Cases_case_response_updated_by_properties'
        version:
          type: string
          example: WzIwNDMxLDFd
    Data_views_400_response:
      title: Bad request
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          example: Bad Request
        message:
          type: string
        statusCode:
          type: number
          example: 400
    Data_views_404_response:
      type: object
      properties:
        error:
          enum:
            - Not Found
          type: string
          example: Not Found
        message:
          type: string
          example: 'Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found'
        statusCode:
          enum:
            - 404
          type: integer
          example: 404
    Data_views_allownoindex:
      type: boolean
      description: Allows the data view saved object to exist before the data is available. Defaults to `false`.
    Data_views_create_data_view_request_object:
      title: Create data view request
      required:
        - data_view
      type: object
      properties:
        data_view:
          required:
            - title
          type: object
          properties:
            allowNoIndex:
              $ref: '#/components/schemas/Data_views_allownoindex'
            fieldAttrs:
              type: object
              additionalProperties:
                $ref: '#/components/schemas/Data_views_fieldattrs'
            fieldFormats:
              $ref: '#/components/schemas/Data_views_fieldformats'
            fields:
              type: object
            id:
              type: string
            name:
              type: string
              description: The data view name.
            namespaces:
              $ref: '#/components/schemas/Data_views_namespaces'
            runtimeFieldMap:
              type: object
              additionalProperties:
                $ref: '#/components/schemas/Data_views_runtimefieldmap'
            sourceFilters:
              $ref: '#/components/schemas/Data_views_sourcefilters'
            timeFieldName:
              $ref: '#/components/schemas/Data_views_timefieldname'
            title:
              $ref: '#/components/schemas/Data_views_title'
            type:
              $ref: '#/components/schemas/Data_views_type'
            typeMeta:
              $ref: '#/components/schemas/Data_views_typemeta'
            version:
              type: string
          description: The data view object.
        override:
          type: boolean
          description: Override an existing data view if a data view with the provided title already exists.
          default: false
    Data_views_data_view_response_object:
      title: Data view response properties
      type: object
      properties:
        data_view:
          type: object
          properties:
            allowNoIndex:
              $ref: '#/components/schemas/Data_views_allownoindex'
            fieldAttrs:
              type: object
              additionalProperties:
                $ref: '#/components/schemas/Data_views_fieldattrs'
            fieldFormats:
              $ref: '#/components/schemas/Data_views_fieldformats'
            fields:
              type: object
            id:
              type: string
              example: ff959d40-b880-11e8-a6d9-e546fe2bba5f
            name:
              type: string
              description: The data view name.
            namespaces:
              $ref: '#/components/schemas/Data_views_namespaces'
            runtimeFieldMap:
              type: object
              additionalProperties:
                $ref: '#/components/schemas/Data_views_runtimefieldmap'
            sourceFilters:
              $ref: '#/components/schemas/Data_views_sourcefilters'
            timeFieldName:
              $ref: '#/components/schemas/Data_views_timefieldname'
            title:
              $ref: '#/components/schemas/Data_views_title'
            typeMeta:
              $ref: '#/components/schemas/Data_views_typemeta_response'
            version:
              type: string
              example: WzQ2LDJd
    Data_views_fieldattrs:
      type: object
      properties:
        count:
          type: integer
          description: Popularity count for the field.
        customDescription:
          maxLength: 300
          type: string
          description: Custom description for the field.
        customLabel:
          type: string
          description: Custom label for the field.
      description: A map of field attributes by field name.
    Data_views_fieldformats:
      type: object
      description: A map of field formats by field name.
    Data_views_namespaces:
      type: array
      items:
        type: string
        default: default
      description: An array of space identifiers for sharing the data view between multiple spaces.
    Data_views_runtimefieldmap:
      required:
        - script
        - type
      type: object
      properties:
        script:
          type: object
          properties:
            source:
              type: string
              description: Script for the runtime field.
        type:
          type: string
          description: Mapping type of the runtime field.
      description: A map of runtime field definitions by field name.
    Data_views_sourcefilters:
      type: array
      items:
        required:
          - value
        type: object
        properties:
          value:
            type: string
      description: The array of field names you want to filter out in Discover.
    Data_views_swap_data_view_request_object:
      title: Data view reference swap request
      required:
        - fromId
        - toId
      type: object
      properties:
        delete:
          type: boolean
          description: Deletes referenced saved object if all references are removed.
        forId:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
          description: Limit the affected saved objects to one or more by identifier.
        forType:
          type: string
          description: Limit the affected saved objects by type.
        fromId:
          type: string
          description: The saved object reference to change.
        fromType:
          type: string
          description: "Specify the type of the saved object reference to alter. The default value is `index-pattern` for data views.\n"
        toId:
          type: string
          description: New saved object reference value to replace the old value.
    Data_views_timefieldname:
      type: string
      description: 'The timestamp field name, which you use for time-based data views.'
    Data_views_title:
      type: string
      description: 'Comma-separated list of data streams, indices, and aliases that you want to search. Supports wildcards (`*`).'
    Data_views_type:
      type: string
      description: 'When set to `rollup`, identifies the rollup data views.'
    Data_views_typemeta:
      required:
        - aggs
        - params
      type: object
      properties:
        aggs:
          type: object
          description: A map of rollup restrictions by aggregation type and field name.
        params:
          type: object
          description: Properties for retrieving rollup fields.
      description: 'When you use rollup indices, contains the field list for the rollup data view API endpoints.'
    Data_views_typemeta_response:
      type:
        - 'null'
        - object
      properties:
        aggs:
          type: object
          description: A map of rollup restrictions by aggregation type and field name.
        params:
          type: object
          description: Properties for retrieving rollup fields.
      description: 'When you use rollup indices, contains the field list for the rollup data view API endpoints.'
    Data_views_update_data_view_request_object:
      title: Update data view request
      required:
        - data_view
      type: object
      properties:
        data_view:
          type: object
          properties:
            allowNoIndex:
              $ref: '#/components/schemas/Data_views_allownoindex'
            fieldFormats:
              $ref: '#/components/schemas/Data_views_fieldformats'
            fields:
              type: object
            name:
              type: string
            runtimeFieldMap:
              type: object
              additionalProperties:
                $ref: '#/components/schemas/Data_views_runtimefieldmap'
            sourceFilters:
              $ref: '#/components/schemas/Data_views_sourcefilters'
            timeFieldName:
              $ref: '#/components/schemas/Data_views_timefieldname'
            title:
              $ref: '#/components/schemas/Data_views_title'
            type:
              $ref: '#/components/schemas/Data_views_type'
            typeMeta:
              $ref: '#/components/schemas/Data_views_typemeta'
          description: "The data view properties you want to update. Only the specified properties are updated in the data view. Unspecified fields stay as they are persisted.\n"
        refresh_fields:
          type: boolean
          description: Reloads the data view fields after the data view is updated.
          default: false
    Kibana_HTTP_APIs__zod_v4_55___schema0:
      anyOf:
        - required:
            - objects
          type: object
          properties:
            objects:
              required:
                - all
              type: object
              properties:
                all:
                  type: object
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        - required:
            - objects
          type: object
          properties:
            objects:
              required:
                - mappings
                - routing
              type: object
              properties:
                mappings:
                  type: boolean
                routing:
                  maxItems: 200
                  type: array
                  items:
                    allOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs__zod_v4_55___schema0'
                      - required:
                          - destination
                        type: object
                        properties:
                          destination:
                            maxLength: 200
                            minLength: 1
                            type: string
              additionalProperties: false
          additionalProperties: false
    Kibana_HTTP_APIs_action_id_response:
      title: action_id_response
      required:
        - actionId
      type: object
      properties:
        actionId:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_action_message_response:
      title: action_message_response
      required:
        - message
      type: object
      properties:
        message:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_agent_policy_response:
      title: agent_policy_response
      required:
        - id
        - name
        - namespace
        - is_protected
        - status
        - updated_at
        - updated_by
        - revision
      type: object
      properties:
        advanced_settings:
          type: object
          properties:
            agent_download_target_directory: { }
            agent_download_timeout: { }
            agent_features_disable_policy_change_acks_enabled: { }
            agent_features_include_tags_in_events_enabled: { }
            agent_internal: { }
            agent_limits_go_max_procs: { }
            agent_logging_files_interval: { }
            agent_logging_files_keepfiles: { }
            agent_logging_files_rotateeverybytes: { }
            agent_logging_level: { }
            agent_logging_metrics_period: { }
            agent_logging_to_files: { }
            agent_monitoring_runtime_experimental: { }
          additionalProperties: false
        agent_features:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - enabled
            type: object
            properties:
              enabled:
                type: boolean
              name:
                type: string
            additionalProperties: false
        agentless:
          type: object
          properties:
            cloud_connectors:
              required:
                - enabled
              type: object
              properties:
                enabled:
                  type: boolean
                target_csp:
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
              additionalProperties: false
            cluster_id:
              type: string
            resources:
              type: object
              properties:
                requests:
                  type: object
                  properties:
                    cpu:
                      type: string
                    memory:
                      type: string
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        agents:
          type: number
        agents_per_version:
          maxItems: 1000
          type: array
          items:
            required:
              - version
              - count
            type: object
            properties:
              count:
                type: number
              version:
                type: string
            additionalProperties: false
        created_at:
          type: string
        data_output_id:
          type:
            - 'null'
            - string
        description:
          type: string
        download_source_id:
          type:
            - 'null'
            - string
          description: Use `download_source_ids` instead
          deprecated: true
        download_source_ids:
          maxItems: 3
          type: array
          items:
            maxLength: 500
            type: string
            description: 'A download source ID, or the reserved value ''default'' to dynamically reference whichever source is currently set as default.'
        fips_agents:
          type: number
        fleet_server_host_id:
          type:
            - 'null'
            - string
        global_data_tags:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
              value:
                type:
                  - number
                  - string
            additionalProperties: false
          description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
        has_agent_version_conditions:
          type: boolean
        has_fleet_server:
          type: boolean
        id:
          type: string
        inactivity_timeout:
          minimum: 0
          type: number
          default: 1209600
        is_default:
          type: boolean
        is_default_fleet_server:
          type: boolean
        is_managed:
          type: boolean
        is_preconfigured:
          type: boolean
        is_protected:
          type: boolean
          description: Indicates whether the agent policy has tamper protection enabled. Defaults to `false`.
        is_verifier:
          type: boolean
        keep_monitoring_alive:
          type:
            - 'null'
            - boolean
          description: 'When set to true, monitoring will be enabled but logs/metrics collection will be disabled'
        min_agent_version:
          type:
            - 'null'
            - string
        monitoring_diagnostics:
          type: object
          properties:
            limit:
              type: object
              properties:
                burst:
                  type: number
                interval:
                  type: string
              additionalProperties: false
            uploader:
              type: object
              properties:
                init_dur:
                  type: string
                max_dur:
                  type: string
                max_retries:
                  type: number
              additionalProperties: false
          additionalProperties: false
        monitoring_enabled:
          maxItems: 3
          type: array
          items:
            enum:
              - logs
              - metrics
              - traces
            type: string
        monitoring_http:
          type: object
          properties:
            buffer:
              type: object
              properties:
                enabled:
                  type: boolean
                  default: false
              additionalProperties: false
            enabled:
              type: boolean
            host:
              type: string
            port:
              maximum: 65353
              minimum: 0
              type: number
          additionalProperties: false
        monitoring_output_id:
          type:
            - 'null'
            - string
        monitoring_pprof_enabled:
          type: boolean
        name:
          minLength: 1
          type: string
        namespace:
          minLength: 1
          type: string
        overrides:
          type:
            - 'null'
            - object
          additionalProperties: { }
          description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
        package_agent_version_conditions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - title
              - version_condition
            type: object
            properties:
              name:
                type: string
              title:
                type: string
              version_condition:
                type: string
            additionalProperties: false
        package_policies:
          anyOf:
            - maxItems: 10000
              type: array
              items:
                type: string
            - maxItems: 10000
              type: array
              items:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
              description: 'This field is present only when retrieving a single agent policy, or when retrieving a list of agent policies with the `?full=true` parameter'
        required_versions:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - version
              - percentage
            type: object
            properties:
              percentage:
                maximum: 100
                minimum: 0
                type: number
                description: Target percentage of agents to auto upgrade
              version:
                type: string
                description: Target version for automatic agent upgrade
            additionalProperties: false
        revision:
          type: number
        schema_version:
          type: string
        space_ids:
          maxItems: 100
          type: array
          items:
            type: string
        status:
          enum:
            - active
            - inactive
          type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the agent policy supports agentless integrations.
        unenroll_timeout:
          minimum: 0
          type: number
        unprivileged_agents:
          type: number
        updated_at:
          type: string
        updated_by:
          type: string
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_aiops_change_point_chart:
      required:
        - data_view_id
        - metric_field
      type: object
      properties:
        aggregation_function:
          anyOf:
            - enum:
                - avg
              type: string
            - enum:
                - sum
              type: string
            - enum:
                - min
              type: string
            - enum:
                - max
              type: string
          description: The aggregation function used to calculate the metric values.
          default: avg
        data_view_id:
          maxLength: 10000
          minLength: 1
          type: string
          description: The data view ID used to run change point detection.
        description:
          type: string
          description: A short description of the panel.
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        max_series_to_plot:
          maximum: 50
          minimum: 1
          type: integer
          description: The maximum number of change points to visualize. Defaults to 6.
          default: 6
        metric_field:
          maxLength: 10000
          minLength: 1
          type: string
          description: The metric field used by the aggregation function.
        partitions:
          maxItems: 10000
          type: array
          items:
            maxLength: 10000
            minLength: 1
            type: string
          description: Optional split field values to include in the panel.
        split_field:
          maxLength: 10000
          minLength: 1
          type: string
          description: The optional field used to split change point results.
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          type: string
          description: The panel title.
        view_type:
          anyOf:
            - enum:
                - charts
              type: string
            - enum:
                - table
              type: string
          description: The type of change point detection view to display.
          default: charts
      additionalProperties: false
      description: Change point detection chart embeddable schema
    Kibana_HTTP_APIs_aiops_log_rate_analysis:
      required:
        - data_view_id
      type: object
      properties:
        data_view_id:
          maxLength: 1000
          minLength: 1
          type: string
          description: The data view ID used to run log rate analysis.
        description:
          type: string
          description: A short description of the panel.
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: Log rate analysis embeddable schema
    Kibana_HTTP_APIs_aiops_pattern_analysis:
      required:
        - data_view_id
        - field_name
      type: object
      properties:
        data_view_id:
          maxLength: 1000
          minLength: 1
          type: string
          description: The data view ID used for pattern analysis.
        description:
          type: string
          description: A short description of the panel.
        field_name:
          maxLength: 1000
          minLength: 1
          type: string
          description: The text field on which to run pattern analysis.
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        minimum_time_range:
          anyOf:
            - enum:
                - no_minimum
              type: string
            - enum:
                - 1_week
              type: string
            - enum:
                - 1_month
              type: string
            - enum:
                - 3_months
              type: string
            - enum:
                - 6_months
              type: string
          description: Minimum time range for pattern analysis.
          default: no_minimum
        random_sampler_mode:
          anyOf:
            - enum:
                - on_automatic
              type: string
            - enum:
                - on_manual
              type: string
            - enum:
                - off
              type: string
          description: The random sampler mode.
          default: on_automatic
        random_sampler_probability:
          maximum: 0.5
          minimum: 1E-05
          type:
            - 'null'
            - number
          description: The probability to use for random sampling (between 0.00001 and 0.5).
          default: 'null'
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: Log Pattern Analysis embeddable schema
    Kibana_HTTP_APIs_alerting_action_policy_destination:
      oneOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_workflow_action_policy_destination'
      description: An action policy destination configuration.
      discriminator:
        propertyName: type
        mapping:
          workflow: '#/components/schemas/Kibana_HTTP_APIs_alerting_workflow_action_policy_destination'
    Kibana_HTTP_APIs_alerting_action_policy_grouping_mode:
      anyOf:
        - enum:
            - per_episode
          type: string
          description: one notification per alert episode lifecycle (default).
        - enum:
            - all
          type: string
          description: a single notification for all matching episodes.
        - enum:
            - per_field
          type: string
          description: group by specified `groupBy` fields.
      description: 'The grouping mode: per_episode groups by episode lifecycle, all sends a single notification for all alerts, per_field groups by the specified fields.'
    Kibana_HTTP_APIs_alerting_action_policy_list_response:
      required:
        - items
        - total
        - page
        - per_page
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_response'
          description: The list of action policies.
        page:
          type: number
          description: The current page number.
        per_page:
          type: number
          description: The number of action policies per page.
        total:
          type: number
          description: The total number of action policies matching the query.
      additionalProperties: false
      description: Paginated list of action policies.
    Kibana_HTTP_APIs_alerting_action_policy_response:
      required:
        - id
        - name
        - description
        - enabled
        - destinations
        - matcher
        - group_by
        - grouping_mode
        - throttle
        - snoozed_until
        - auth
        - created_by
        - created_at
        - updated_by
        - updated_at
      type: object
      properties:
        auth:
          required:
            - owner
            - created_by_user
          type: object
          properties:
            created_by_user:
              type: boolean
              description: Whether this policy was created by a user (vs system-generated).
            owner:
              type: string
              description: The owner of the action policy.
          additionalProperties: false
          description: Authentication and ownership information.
        created_at:
          type: string
          description: The ISO datetime when the action policy was created.
        created_by:
          type:
            - 'null'
            - string
          description: The user ID who created the action policy.
        description:
          type: string
          description: A description of the action policy.
        destinations:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination'
          description: The list of destinations.
        enabled:
          type: boolean
          description: Whether the action policy is enabled.
        group_by:
          type:
            - 'null'
            - array
          items:
            type: string
          description: 'The fields used to group alerts, or null for no grouping.'
        grouping_mode:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_mode'
          description: The grouping mode for alert notifications.
        id:
          type: string
          description: The unique identifier for the action policy.
        matcher:
          type:
            - 'null'
            - object
          properties:
            expression:
              maxLength: 4096
              type:
                - 'null'
                - string
              description: 'A KQL query that''s evaluated against each alert. Supported fields are: `episode_id`, `episode_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule''s query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won''t work. Omit `matcher.expression` or set it to `null` to match on `tags` alone.'
            tags:
              maxItems: 50
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: Rule tags this policy should match. The policy applies to alerts from any rule that has at least one of these tags. Omit `matcher.tags` or set it to `null` to match on `matcher.expression` alone.
          additionalProperties: false
          description: 'Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those tags. Set `expression` to a KQL query, which will be evaluated against each alert. <br/><br/> If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. When `matcher` is `null`, or when both `tags` and `expression` are empty, the policy applies to all alerts.'
        name:
          type: string
          description: The name of the action policy.
        snoozed_until:
          type:
            - 'null'
            - string
          description: 'The ISO datetime until which the policy is snoozed, or null if not snoozed.'
        throttle:
          required:
            - interval
          type:
            - 'null'
            - object
          properties:
            interval:
              maxLength: 32
              type:
                - 'null'
                - string
              description: 'The throttle interval duration (e.g. 5m, 1h), or null when the strategy is intervalless.'
            strategy:
              anyOf:
                - enum:
                    - on_status_change
                  type: string
                  description: notify only on episode status transitions (default for `per_episode`).
                - enum:
                    - per_status_interval
                  type: string
                  description: notify on transitions and at regular intervals.
                - enum:
                    - time_interval
                  type: string
                  description: notify at regular intervals regardless of status (default for `all`/`per_field`).
                - enum:
                    - every_time
                  type: string
                  description: notify on every evaluation cycle (high volume).
              description: The throttle strategy.
          additionalProperties: false
          description: The throttle configuration for notifications.
        updated_at:
          type: string
          description: The ISO datetime when the action policy was last updated.
        updated_by:
          type:
            - 'null'
            - string
          description: The user ID who last updated the action policy.
        version:
          type: string
          description: 'The version, used for optimistic concurrency control.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_action_policy_throttle:
      type: object
      properties:
        interval:
          maxLength: 32
          type:
            - 'null'
            - string
          description: 'The throttle interval duration (e.g. 5m, 1h), or null when the strategy is intervalless.'
        strategy:
          anyOf:
            - enum:
                - on_status_change
              type: string
              description: notify only on episode status transitions (default for `per_episode`).
            - enum:
                - per_status_interval
              type: string
              description: notify on transitions and at regular intervals.
            - enum:
                - time_interval
              type: string
              description: notify at regular intervals regardless of status (default for `all`/`per_field`).
            - enum:
                - every_time
              type: string
              description: notify on every evaluation cycle (high volume).
          description: The throttle strategy.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_ack_episodes_item:
      required:
        - episode_id
      type: object
      properties:
        episode_id:
          maxLength: 150
          minLength: 1
          type: string
          description: Identifier of the alert episode to apply the action to.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_ack_episodes_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_ack_episodes_item'
          description: List of 1 to 100 ack actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_activate_episodes_item:
      required:
        - reason
        - episode_id
      type: object
      properties:
        episode_id:
          maxLength: 150
          minLength: 1
          type: string
          description: Identifier of the alert episode to apply the action to.
        reason:
          maxLength: 1024
          minLength: 1
          type: string
          description: Reason for activating the alert.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_activate_episodes_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_activate_episodes_item'
          description: List of 1 to 100 activate actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_assign_episodes_item:
      required:
        - assignee_uid
        - episode_id
      type: object
      properties:
        assignee_uid:
          maxLength: 256
          type:
            - 'null'
            - string
          description: 'User profile UID of the assignee, or null to remove the assignee from the episode.'
        episode_id:
          maxLength: 150
          minLength: 1
          type: string
          description: Identifier of the alert episode to apply the action to.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_assign_episodes_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_assign_episodes_item'
          description: List of 1 to 100 assign actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_by_ids_request:
      required:
        - ids
      type: object
      properties:
        ids:
          maxItems: 100
          minItems: 1
          type: array
          items:
            maxLength: 150
            minLength: 1
            type: string
          description: Explicit list of IDs to operate on.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_by_query_request:
      type: object
      properties:
        filter:
          maxLength: 4096
          minLength: 1
          type: string
          description: 'KQL filter string to match target resources. At most 10000 matching resources are processed per request. Cannot be empty; to target every resource use `match_all: true`.'
        force:
          type: boolean
          description: 'When true, executes the operation. When false (default), returns a dry-run preview with `match_count` and a `sample` of matching resource IDs so the client can verify before committing.'
          default: false
        match_all:
          enum:
            - true
          type: boolean
          description: 'When true, targets every resource. Requires an explicit opt-in. Omitted by default.'
        search:
          maxLength: 256
          minLength: 1
          type: string
          description: 'Free-text search string matched against the resource-defined searchable fields. Cannot be empty; to target every resource use `match_all: true`.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_create_rule_item:
      required:
        - kind
        - metadata
        - schedule
        - query
      type: object
      properties:
        artifacts:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          description: 'Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.'
        enabled:
          type: boolean
          description: 'If `true` (default), the rule runs on its schedule after creation. If `false`, the rule is saved but does not run until you enable it.'
          default: true
        grouping:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        id:
          maxLength: 150
          minLength: 1
          type: string
          description: 'Optional rule ID. If omitted, Kibana generates one. IDs in the request must be unique.'
        kind:
          anyOf:
            - enum:
                - alert
              type: string
              description: Creates an alert for each matching group and tracks it until it recovers. Use this when you want to detect a problem and notify or automate a response.
            - enum:
                - signal
              type: string
              description: Stores each match as a rule event you can query. Alerts are not created and notifications are not sent.
          description: Whether the rule creates alerts (`alert`) or only stores matching events (`signal`).
        metadata:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata'
        no_data_strategy:
          anyOf:
            - enum:
                - last_known_status
              type: string
              description: Keeps the alert's last status when the rule finds no data.
            - enum:
                - emit
              type: string
              description: Not accepted when creating or updating rules. Do not send this value.
            - enum:
                - recover
              type: string
              description: Marks the alert `inactive` the first time the rule finds no data for the alert.
            - enum:
                - none
              type: string
              description: Ignores runs where the rule finds no data.
          description: 'How the rule behaves when it finds no data for a group. If you omit this field or set it to `none`, those runs are ignored. If you set `last_known_status` or `recover`, a standalone query (`query.format: standalone`) must include `query.no_data`. A composed query (`query.format: composed`) uses `query.base` to detect whether data is present. The `emit` value is not accepted when creating or updating rules.'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
            - enum:
                - no_breach
              type: string
              description: Recovers an alert when the breach query no longer returns matches.
            - enum:
                - query
              type: string
              description: Recovers an alert when a separate recovery query matches. Requires `query.recovery`.
            - enum:
                - none
              type: string
              description: 'The rule never marks an alert as `recovered`, even after the breach query stops returning matches.'
          description: 'The condition that marks an alert recovered. If omitted or set to `none`, recovery is disabled: the alert stays `active` even after the breach query stops returning matches, and `state_transition.recovering_count` / `recovering_timeframe` are not allowed. Set to `no_breach` to recover when the breach query stops returning matches. Set to `query` only when you also provide `query.recovery`.'
        schedule:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule'
        state_transition:
          type:
            - 'null'
            - object
          properties:
            pending_count:
              maximum: 1000
              minimum: 0
              type: integer
              description: Number of consecutive matches required before the alert becomes `active`.
            pending_operator:
              enum:
                - AND
                - OR
              type: string
              description: The operator that combines `pending_count` and `pending_timeframe`. `AND` requires both. `OR` requires either.
            pending_timeframe:
              maxLength: 32
              type: string
              description: 'Time window used with `pending_count`, for example `5m` or `15m`.'
            recovering_count:
              maximum: 1000
              minimum: 0
              type: integer
              description: Number of consecutive recoveries required before the alert becomes `inactive`.
            recovering_operator:
              enum:
                - AND
                - OR
              type: string
              description: The operator that combines `recovering_count` and `recovering_timeframe`. `AND` requires both. `OR` requires either.
            recovering_timeframe:
              maxLength: 32
              type: string
              description: 'Time window used with `recovering_count`, for example `5m` or `15m`.'
          additionalProperties: false
          description: Consecutive-match or time requirements before an alert becomes `active` or `inactive`. Applies only when `kind` is `alert`.
        time_field:
          maxLength: 128
          minLength: 1
          type: string
          description: Document field used as the event time when applying the lookback window. Defaults to `@timestamp`.
          default: '@timestamp'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_create_rules_request:
      required:
        - rules
      type: object
      properties:
        rules:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_create_rule_item'
          description: The rules to create. Must contain between 1 and 100 rules.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_create_rules_response:
      required:
        - rules
        - errors
      type: object
      properties:
        errors:
          type: array
          items:
            required:
              - id
              - error
            type: object
            properties:
              error:
                required:
                  - code
                  - message
                type: object
                properties:
                  code:
                    type: string
                    description: 'Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.'
                  details:
                    type: object
                    additionalProperties: { }
                    description: 'Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.'
                  message:
                    type: string
                    description: A readable explanation of the error. The wording can change without notice. Do not parse this field.
              id:
                type: string
                description: The identifier of the resource that failed.
          description: Errors for rules that could not be created. Each entry includes the rule `id` and the error. Empty when every requested rule was created.
        rules:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: Rules that were created. Rules listed in `errors` are not included.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_deactivate_episodes_item:
      required:
        - reason
        - episode_id
      type: object
      properties:
        episode_id:
          maxLength: 150
          minLength: 1
          type: string
          description: Identifier of the alert episode to apply the action to.
        reason:
          maxLength: 1024
          minLength: 1
          type: string
          description: Reason for deactivating the alert.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_deactivate_episodes_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_deactivate_episodes_item'
          description: List of 1 to 100 deactivate actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_dry_run_response:
      required:
        - match_count
        - sample
      type: object
      properties:
        match_count:
          maximum: 9007199254740991
          minimum: 0
          type: integer
          description: 'Total number of resources matching the query. A dry run never fails on size, but if this exceeds 10000, re-sending the same query with `force: true` is rejected with `BULK_QUERY_MATCH_LIMIT_EXCEEDED`; narrow the query before executing.'
        sample:
          maxItems: 100
          type: array
          items:
            type: string
          description: Sample of matching resource IDs (up to 100) for spot-checking before executing.
      additionalProperties: false
      description: Dry-run preview returned by a by-query bulk endpoint when `force` is false.
    Kibana_HTTP_APIs_alerting_bulk_get_rules_response:
      required:
        - rules
      type: object
      properties:
        rules:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: 'The requested rules, in the same order as the requested ids.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_operation_response:
      required:
        - affected_count
        - errors
      type: object
      properties:
        affected_count:
          maximum: 9007199254740991
          minimum: 0
          type: integer
          description: Number of resources the operation successfully touched.
        errors:
          type: array
          items:
            required:
              - id
              - error
            type: object
            properties:
              error:
                required:
                  - code
                  - message
                type: object
                properties:
                  code:
                    type: string
                    description: 'Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.'
                  details:
                    type: object
                    additionalProperties: { }
                    description: 'Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.'
                  message:
                    type: string
                    description: A readable explanation of the error. The wording can change without notice. Do not parse this field.
              id:
                type: string
                description: The identifier of the resource that failed.
          description: Errors encountered during the operation.
      additionalProperties: false
      description: Result of an executed bulk operation.
    Kibana_HTTP_APIs_alerting_bulk_snooze_action_policies_request:
      required:
        - ids
        - snoozed_until
      type: object
      properties:
        ids:
          maxItems: 100
          minItems: 1
          type: array
          items:
            maxLength: 150
            minLength: 1
            type: string
          description: Explicit list of IDs to operate on.
        snoozed_until:
          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
          type: string
          description: The ISO datetime until which the targeted action policies should be snoozed.
          format: date-time
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_snooze_series_item:
      required:
        - group_hash
      type: object
      properties:
        expiry:
          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
          type: string
          description: ISO datetime when snooze should expire.
          format: date-time
        group_hash:
          maxLength: 256
          minLength: 1
          type: string
          description: Hash identifying the alert episode series to apply the action to.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_snooze_series_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_snooze_series_item'
          description: List of 1 to 100 snooze actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_tag_episodes_item:
      required:
        - tags
        - episode_id
      type: object
      properties:
        episode_id:
          maxLength: 150
          minLength: 1
          type: string
          description: Identifier of the alert episode to apply the action to.
        tags:
          maxItems: 20
          type: array
          items:
            maxLength: 128
            minLength: 1
            type: string
          description: List of tags to add to the episode.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_tag_episodes_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_tag_episodes_item'
          description: List of 1 to 100 tag actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_unack_episodes_item:
      required:
        - episode_id
      type: object
      properties:
        episode_id:
          maxLength: 150
          minLength: 1
          type: string
          description: Identifier of the alert episode to apply the action to.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_unack_episodes_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unack_episodes_item'
          description: List of 1 to 100 unack actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_unsnooze_series_item:
      required:
        - group_hash
      type: object
      properties:
        group_hash:
          maxLength: 256
          minLength: 1
          type: string
          description: Hash identifying the alert episode series to apply the action to.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_bulk_unsnooze_series_request:
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_bulk_unsnooze_series_item'
          description: List of 1 to 100 unsnooze actions to create.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_composed_rule_query:
      required:
        - format
        - base
      type: object
      properties:
        base:
          maxLength: 10000
          minLength: 1
          type: string
          description: Base ES|QL query. Time filters are applied automatically via the lookback window.
        breach:
          required:
            - segment
          type: object
          properties:
            segment:
              maxLength: 10000
              minLength: 1
              type: string
              description: A clause appended to the end of the rule's ES|QL query. Required in breach blocks.
          additionalProperties: false
          description: Breach detection configuration. Omit to treat every base row as a breach.
        format:
          enum:
            - composed
          type: string
        recovery:
          required:
            - segment
          type: object
          properties:
            segment:
              maxLength: 10000
              minLength: 1
              type: string
              description: Appendable ES|QL segment for recovery detection.
          additionalProperties: false
          description: Recovery query segment. Required when recovery_strategy is "query".
      additionalProperties: false
      description: 'Composed query: a shared base with appendable breach and recovery segments.'
    Kibana_HTTP_APIs_alerting_error_response:
      required:
        - code
        - error
        - message
      type: object
      properties:
        code:
          type: string
          description: 'Stable error code you can branch on, for example `INVALID_SCHEDULE` or `RULE_ALREADY_EXISTS`.'
        details:
          type: object
          additionalProperties: { }
          description: 'Optional extra information about the error, for example field validation issues or the `rule_id` when that ID already exists.'
        error:
          type: string
          description: 'A short human-readable summary of the error category (e.g., "Not Found", "Bad Request"). Subject to change without notice. Do not parse or rely on its content.'
        message:
          type: string
          description: A readable explanation of the error. The wording can change without notice. Do not parse this field.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_ack_episode_action:
      type: object
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_action_policy:
      required:
        - name
        - description
        - destinations
      type: object
      properties:
        description:
          maxLength: 1024
          type: string
          description: A description of the action policy.
        destinations:
          maxItems: 10
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination'
          description: The list of destinations. At least one is required.
        group_by:
          maxItems: 16
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
          description: The fields used to group alerts.
        grouping_mode:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_mode'
        matcher:
          type: object
          properties:
            expression:
              maxLength: 4096
              type:
                - 'null'
                - string
              description: 'A KQL query that''s evaluated against each alert. Supported fields are: `episode_id`, `episode_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule''s query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won''t work. Omit `matcher.expression` or set it to `null` to match on `tags` alone.'
            tags:
              maxItems: 50
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: Rule tags this policy should match. The policy applies to alerts from any rule that has at least one of these tags. Omit `matcher.tags` or set it to `null` to match on `matcher.expression` alone.
          additionalProperties: false
          description: 'Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those tags. Set `expression` to a KQL query, which will be evaluated against each alert. <br/><br/> If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. When `matcher` is `null`, or when both `tags` and `expression` are empty, the policy applies to all alerts.'
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: The name of the action policy.
        throttle:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_activate_episode_action:
      required:
        - reason
      type: object
      properties:
        reason:
          maxLength: 1024
          minLength: 1
          type: string
          description: Reason for activating the alert.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_assign_episode_action:
      required:
        - assignee_uid
      type: object
      properties:
        assignee_uid:
          maxLength: 256
          type:
            - 'null'
            - string
          description: 'User profile UID of the assignee, or null to remove the assignee from the episode.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_deactivate_episode_action:
      required:
        - reason
      type: object
      properties:
        reason:
          maxLength: 1024
          minLength: 1
          type: string
          description: Reason for deactivating the alert.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_rule:
      required:
        - kind
        - metadata
        - schedule
        - query
      type: object
      properties:
        artifacts:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          description: 'Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.'
        grouping:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        kind:
          anyOf:
            - enum:
                - alert
              type: string
              description: Creates an alert for each matching group and tracks it until it recovers. Use this when you want to detect a problem and notify or automate a response.
            - enum:
                - signal
              type: string
              description: Stores each match as a rule event you can query. Alerts are not created and notifications are not sent.
          description: Whether the rule creates alerts (`alert`) or only stores matching events (`signal`).
        metadata:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_metadata'
        no_data_strategy:
          anyOf:
            - enum:
                - last_known_status
              type: string
              description: Keeps the alert's last status when the rule finds no data.
            - enum:
                - emit
              type: string
              description: Not accepted when creating or updating rules. Do not send this value.
            - enum:
                - recover
              type: string
              description: Marks the alert `inactive` the first time the rule finds no data for the alert.
            - enum:
                - none
              type: string
              description: Ignores runs where the rule finds no data.
          description: 'How the rule behaves when it finds no data for a group. If you omit this field or set it to `none`, those runs are ignored. If you set `last_known_status` or `recover`, a standalone query (`query.format: standalone`) must include `query.no_data`. A composed query (`query.format: composed`) uses `query.base` to detect whether data is present. The `emit` value is not accepted when creating or updating rules.'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
            - enum:
                - no_breach
              type: string
              description: Recovers an alert when the breach query no longer returns matches.
            - enum:
                - query
              type: string
              description: Recovers an alert when a separate recovery query matches. Requires `query.recovery`.
            - enum:
                - none
              type: string
              description: 'The rule never marks an alert as `recovered`, even after the breach query stops returning matches.'
          description: 'The condition that marks an alert recovered. If omitted or set to `none`, recovery is disabled: the alert stays `active` even after the breach query stops returning matches, and `state_transition.recovering_count` / `recovering_timeframe` are not allowed. Set to `no_breach` to recover when the breach query stops returning matches. Set to `query` only when you also provide `query.recovery`.'
        schedule:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule'
        state_transition:
          type:
            - 'null'
            - object
          properties:
            pending_count:
              maximum: 1000
              minimum: 0
              type: integer
              description: Number of consecutive matches required before the alert becomes `active`.
            pending_operator:
              enum:
                - AND
                - OR
              type: string
              description: The operator that combines `pending_count` and `pending_timeframe`. `AND` requires both. `OR` requires either.
            pending_timeframe:
              maxLength: 32
              type: string
              description: 'Time window used with `pending_count`, for example `5m` or `15m`.'
            recovering_count:
              maximum: 1000
              minimum: 0
              type: integer
              description: Number of consecutive recoveries required before the alert becomes `inactive`.
            recovering_operator:
              enum:
                - AND
                - OR
              type: string
              description: The operator that combines `recovering_count` and `recovering_timeframe`. `AND` requires both. `OR` requires either.
            recovering_timeframe:
              maxLength: 32
              type: string
              description: 'Time window used with `recovering_count`, for example `5m` or `15m`.'
          additionalProperties: false
          description: Consecutive-match or time requirements before an alert becomes `active` or `inactive`. Applies only when `kind` is `alert`.
        time_field:
          maxLength: 128
          minLength: 1
          type: string
          description: Document field used as the event time when applying the lookback window. Defaults to `@timestamp`.
          default: '@timestamp'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_snooze_series_action:
      type: object
      properties:
        expiry:
          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
          type: string
          description: ISO datetime when snooze should expire.
          format: date-time
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_tag_episode_action:
      required:
        - tags
      type: object
      properties:
        tags:
          maxItems: 20
          type: array
          items:
            maxLength: 128
            minLength: 1
            type: string
          description: List of tags to add to the episode.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_unack_episode_action:
      type: object
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_new_unsnooze_series_action:
      type: object
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_policy_execution_history_item:
      required:
        - dispatched_at
        - policy
        - outcome
        - episode_count
        - action_group_count
        - rules
        - total_rule_count
        - workflows
      type: object
      properties:
        action_group_count:
          type: number
        dispatched_at:
          type: string
        episode_count:
          type: number
        episodes:
          maxItems: 50
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
          description: 'Episode ids referenced by this event, bounded to MAX_EMBEDDED_EPISODES_PER_ITEM. Use `episode_count` for the true total.'
        error:
          required:
            - message
          type: object
          properties:
            message:
              type: string
          additionalProperties: false
        failure_reason:
          enum:
            - missing_api_key
            - workflow_not_found
            - workflow_disabled
            - schedule_error
          type: string
        outcome:
          enum:
            - dispatched
            - throttled
            - dispatch_failed
          type: string
        policy:
          required:
            - id
          type: object
          properties:
            id:
              type: string
            name:
              type:
                - 'null'
                - string
          additionalProperties: false
        rules:
          maxItems: 20
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
              name:
                type:
                  - 'null'
                  - string
          description: 'Rules referenced by this event, bounded to MAX_EMBEDDED_RULES_PER_ITEM. When a search or rule filter narrows the match, this array is intersected with the matched subset server-side. Use `total_rule_count` for the full count.'
        total_rule_count:
          type: number
          description: Total number of rules referenced by this event after search / rule-filter narrowing. May exceed `rules.length` when the embedded array is truncated to the cap.
        workflows:
          maxItems: 100
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
              name:
                type:
                  - 'null'
                  - string
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_policy_execution_history_response:
      required:
        - items
        - page
        - per_page
        - total_events
        - search_matches
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_policy_execution_history_item'
        page:
          maximum: 9007199254740991
          minimum: 1
          type: integer
        per_page:
          maximum: 9007199254740991
          minimum: 0
          type: integer
        search_matches:
          required:
            - policies
            - rules
            - cap
          type:
            - 'null'
            - object
          properties:
            cap:
              type: number
              description: Maximum number of policy/rule ids the server uses as a filter.
            policies:
              type: number
              description: Total policies matching the search.
            rules:
              type: number
              description: Total rules matching the search.
          additionalProperties: false
          description: 'Per-type match counts for the active search, plus the cap used as filter. Null when no search was provided. When policies > cap or rules > cap the result is truncated.'
        total_events:
          maximum: 9007199254740991
          minimum: 0
          type: integer
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_rule_artifact:
      required:
        - id
        - type
        - data
      type: object
      properties:
        data:
          type: object
          additionalProperties: { }
          description: Structured artifact data.
        id:
          maxLength: 256
          minLength: 1
          type: string
          description: Artifact identifier.
        type:
          maxLength: 128
          minLength: 1
          type: string
          description: Artifact type.
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_rule_execution:
      required:
        - id
        - rule
        - space_id
        - started_at
        - ended_at
        - timings
        - outcome
        - reason
        - error
      type: object
      properties:
        ended_at:
          type: string
        error:
          required:
            - message
            - stack_trace
          type:
            - 'null'
            - object
          properties:
            message:
              type: string
            stack_trace:
              type:
                - 'null'
                - string
          additionalProperties: false
        id:
          type: string
        outcome:
          enum:
            - success
            - failure
          type: string
        reason:
          type:
            - 'null'
            - string
        rule:
          required:
            - id
            - version
          type: object
          properties:
            id:
              type: string
            version:
              maximum: 9007199254740991
              minimum: -9007199254740991
              type:
                - 'null'
                - integer
          additionalProperties: false
        space_id:
          type: string
        started_at:
          type: string
        timings:
          required:
            - duration
            - scheduled_delay
          type: object
          properties:
            duration:
              maximum: 9007199254740991
              minimum: 0
              type: integer
            scheduled_delay:
              maximum: 9007199254740991
              minimum: -9007199254740991
              type: integer
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_rule_executions_response:
      required:
        - items
        - total
        - page
        - per_page
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_execution'
        page:
          maximum: 9007199254740991
          minimum: 1
          type: integer
        per_page:
          maximum: 9007199254740991
          minimum: 1
          type: integer
        total:
          maximum: 9007199254740991
          minimum: 0
          type: integer
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_rule_grouping:
      required:
        - fields
      type: object
      properties:
        fields:
          maxItems: 16
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
          description: 'Fields to group alerts by, e.g. ["host.name", "service.name"]. Should match ES|QL GROUP BY fields.'
      additionalProperties: false
      description: Grouping configuration.
    Kibana_HTTP_APIs_alerting_rule_list_response:
      required:
        - items
        - total
        - page
        - per_page
      type: object
      properties:
        items:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response'
          description: The list of rules.
        page:
          type: number
          description: The current page number.
        per_page:
          type: number
          description: The number of rules per page.
        total:
          type: number
          description: The total number of rules matching the query.
      additionalProperties: false
      description: Paginated list of rules.
    Kibana_HTTP_APIs_alerting_rule_metadata:
      required:
        - name
      type: object
      properties:
        builder_type:
          maxLength: 64
          type: string
          description: Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.
        description:
          maxLength: 1024
          type: string
          description: Human-readable description of the rule.
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: Rule name (must be unique within the space).
        owner:
          maxLength: 256
          type: string
          description: Owner of the rule.
        tags:
          maxItems: 20
          minItems: 1
          type: array
          items:
            maxLength: 128
            minLength: 1
            type: string
          description: 'Tags for categorization, e.g. ["production", "infra"].'
      additionalProperties: false
      description: Rule metadata.
    Kibana_HTTP_APIs_alerting_rule_query:
      oneOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_composed_rule_query'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_standalone_rule_query'
      description: Detection query configuration.
      discriminator:
        propertyName: format
        mapping:
          composed: '#/components/schemas/Kibana_HTTP_APIs_alerting_composed_rule_query'
          standalone: '#/components/schemas/Kibana_HTTP_APIs_alerting_standalone_rule_query'
    Kibana_HTTP_APIs_alerting_rule_response:
      required:
        - kind
        - metadata
        - schedule
        - query
        - id
        - enabled
        - created_by
        - created_at
        - updated_by
        - updated_at
      type: object
      properties:
        artifacts:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          description: 'Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.'
        created_at:
          type: string
          description: ISO timestamp when the rule was created.
        created_by:
          type:
            - 'null'
            - string
          description: User who created the rule.
        enabled:
          type: boolean
          description: Whether the rule is enabled.
        grouping:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        id:
          type: string
          description: Unique rule identifier.
        kind:
          anyOf:
            - enum:
                - alert
              type: string
              description: Creates an alert for each matching group and tracks it until it recovers. Use this when you want to detect a problem and notify or automate a response.
            - enum:
                - signal
              type: string
              description: Stores each match as a rule event you can query. Alerts are not created and notifications are not sent.
          description: Whether the rule creates alerts (`alert`) or only stores matching events (`signal`).
        metadata:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_response_metadata'
        no_data_strategy:
          anyOf:
            - enum:
                - last_known_status
              type: string
              description: Keeps the alert's last status when the rule finds no data.
            - enum:
                - emit
              type: string
              description: Not accepted when creating or updating rules. Do not send this value.
            - enum:
                - recover
              type: string
              description: Marks the alert `inactive` the first time the rule finds no data for the alert.
            - enum:
                - none
              type: string
              description: Ignores runs where the rule finds no data.
          description: 'How the rule behaves when it finds no data for a group. If you omit this field or set it to `none`, those runs are ignored. If you set `last_known_status` or `recover`, a standalone query (`query.format: standalone`) must include `query.no_data`. A composed query (`query.format: composed`) uses `query.base` to detect whether data is present. The `emit` value is not accepted when creating or updating rules.'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
            - enum:
                - no_breach
              type: string
              description: Recovers an alert when the breach query no longer returns matches.
            - enum:
                - query
              type: string
              description: Recovers an alert when a separate recovery query matches. Requires `query.recovery`.
            - enum:
                - none
              type: string
              description: 'The rule never marks an alert as `recovered`, even after the breach query stops returning matches.'
          description: 'The condition that marks an alert recovered. If omitted or set to `none`, recovery is disabled: the alert stays `active` even after the breach query stops returning matches, and `state_transition.recovering_count` / `recovering_timeframe` are not allowed. Set to `no_breach` to recover when the breach query stops returning matches. Set to `query` only when you also provide `query.recovery`.'
        schedule:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_schedule'
        state_transition:
          type:
            - 'null'
            - object
          properties:
            pending_count:
              maximum: 1000
              minimum: 0
              type: integer
              description: Number of consecutive matches required before the alert becomes `active`.
            pending_operator:
              enum:
                - AND
                - OR
              type: string
              description: The operator that combines `pending_count` and `pending_timeframe`. `AND` requires both. `OR` requires either.
            pending_timeframe:
              maxLength: 32
              type: string
              description: 'Time window used with `pending_count`, for example `5m` or `15m`.'
            recovering_count:
              maximum: 1000
              minimum: 0
              type: integer
              description: Number of consecutive recoveries required before the alert becomes `inactive`.
            recovering_operator:
              enum:
                - AND
                - OR
              type: string
              description: The operator that combines `recovering_count` and `recovering_timeframe`. `AND` requires both. `OR` requires either.
            recovering_timeframe:
              maxLength: 32
              type: string
              description: 'Time window used with `recovering_count`, for example `5m` or `15m`.'
          additionalProperties: false
          description: Consecutive-match or time requirements before an alert becomes `active` or `inactive`. Applies only when `kind` is `alert`.
        time_field:
          maxLength: 128
          minLength: 1
          type: string
          description: Document field used as the event time when applying the lookback window. Defaults to `@timestamp`.
          default: '@timestamp'
        updated_at:
          type: string
          description: ISO timestamp when the rule was last updated.
        updated_by:
          type:
            - 'null'
            - string
          description: User who last updated the rule.
        version:
          type: string
          description: 'The saved object version token of the rule, used for optimistic concurrency control.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_rule_response_metadata:
      required:
        - name
        - version
      type: object
      properties:
        builder_type:
          maxLength: 64
          type: string
          description: Identifies the rule builder that authored this rule (e.g. "threshold"). Absent for rules authored directly in ES|QL.
        description:
          maxLength: 1024
          type: string
          description: Human-readable description of the rule.
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: Rule name (must be unique within the space).
        owner:
          maxLength: 256
          type: string
          description: Owner of the rule.
        tags:
          maxItems: 20
          minItems: 1
          type: array
          items:
            maxLength: 128
            minLength: 1
            type: string
          description: 'Tags for categorization, e.g. ["production", "infra"].'
        version:
          maximum: 9007199254740991
          minimum: 1
          type: integer
          description: 'Monotonically increasing integer number representing a rule configuration version, incremented on every change. Used on generated rule events as `rule.version`.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_rule_schedule:
      required:
        - every
      type: object
      properties:
        every:
          maxLength: 32
          type: string
          description: 'Execution interval, e.g. 1m, 5m, 1h.'
        lookback:
          maxLength: 32
          type: string
          description: 'Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.'
      additionalProperties: false
      description: Execution schedule configuration.
    Kibana_HTTP_APIs_alerting_snooze_action_policy_request:
      required:
        - snoozed_until
      type: object
      properties:
        snoozed_until:
          pattern: '^(?:(?:\d\d[2468][048]|\d\d[13579][26]|\d\d0[48]|[02468][048]00|[13579][26]00)-02-29|\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\d|30)|(?:02)-(?:0[1-9]|1\d|2[0-8])))T(?:(?:[01]\d|2[0-3]):[0-5]\d(?::[0-5]\d(?:\.\d+)?)?(?:Z))$'
          type: string
          description: The ISO datetime until which the action policy should be snoozed.
          format: date-time
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_standalone_rule_query:
      required:
        - format
        - breach
      type: object
      properties:
        breach:
          required:
            - query
          type: object
          properties:
            query:
              maxLength: 10000
              minLength: 1
              type: string
              description: Full ES|QL query for breach detection (required).
          additionalProperties: false
          description: Breach detection configuration (required).
        format:
          enum:
            - standalone
          type: string
        no_data:
          required:
            - query
          type: object
          properties:
            query:
              maxLength: 10000
              minLength: 1
              type: string
              description: Full ES|QL query that detects presence of data.
          additionalProperties: false
          description: No-data detection query. Required when no_data_strategy is not "none".
        recovery:
          required:
            - query
          type: object
          properties:
            query:
              maxLength: 10000
              minLength: 1
              type: string
              description: Full ES|QL query for recovery detection.
          additionalProperties: false
          description: Recovery query. Required when recovery_strategy is "query".
      additionalProperties: false
      description: 'Standalone queries: independent full queries for breach, recovery, and no_data.'
    Kibana_HTTP_APIs_alerting_update_action_policy:
      required:
        - version
      type: object
      properties:
        description:
          maxLength: 1024
          type: string
          description: A description of the action policy.
        destinations:
          maxItems: 10
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_destination'
          description: The list of destinations. At least one is required.
        group_by:
          maxItems: 16
          type:
            - 'null'
            - array
          items:
            maxLength: 256
            minLength: 1
            type: string
          description: The fields used to group alerts.
        grouping_mode:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_grouping_mode'
          description: The grouping mode for alert notifications.
        matcher:
          type:
            - 'null'
            - object
          properties:
            expression:
              maxLength: 4096
              type:
                - 'null'
                - string
              description: 'A KQL query that''s evaluated against each alert. Supported fields are: `episode_id`, `episode_status`, `group_hash`, `last_event_timestamp`, `severity`, and your rule''s query output columns under `data.*` (for example, `data.host.name`). Referencing other fields won''t work. Omit `matcher.expression` or set it to `null` to match on `tags` alone.'
            tags:
              maxItems: 50
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: Rule tags this policy should match. The policy applies to alerts from any rule that has at least one of these tags. Omit `matcher.tags` or set it to `null` to match on `matcher.expression` alone.
          additionalProperties: false
          description: 'Selects the alerts this policy applies to. Set `tags` to match alerts from rules with those tags. Set `expression` to a KQL query, which will be evaluated against each alert. <br/><br/> If you set both `tags` and `expression`, an alert must match the tags and the expression for the policy to apply. When `matcher` is `null`, or when both `tags` and `expression` are empty, the policy applies to all alerts. <br/><br/> Updating `matcher` replaces it entirely: to change `tags` without dropping `expression`, resend the current `expression` value.'
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: The name of the action policy.
        throttle:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_action_policy_throttle'
          description: The throttle configuration for notifications.
        version:
          maxLength: 256
          minLength: 1
          type: string
          description: 'The current version of the action policy, used for optimistic concurrency control.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_update_rule:
      type: object
      properties:
        artifacts:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_artifact'
          description: 'Optional objects attached to the rule, such as a runbook or a dashboard. Each item has `id`, `type`, and `data`. The shape of `data` depends on `type`. For example, a `runbook` uses `content` and a `dashboard` uses `dashboard_id`. Known types are validated against that shape. Unknown types are stored when `id`, `type`, and `data` are present.'
        grouping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_grouping'
        metadata:
          type: object
          properties:
            builder_type:
              maxLength: 64
              type:
                - 'null'
                - string
            description:
              maxLength: 1024
              type: string
              description: Human-readable description of the rule.
            name:
              maxLength: 256
              minLength: 1
              type: string
              description: Rule name (must be unique within the space).
            owner:
              maxLength: 256
              type: string
              description: Owner of the rule.
            tags:
              maxItems: 20
              minItems: 1
              type:
                - 'null'
                - array
              items:
                maxLength: 128
                minLength: 1
                type: string
          additionalProperties: false
        no_data_strategy:
          anyOf:
            - enum:
                - last_known_status
              type: string
              description: Keeps the alert's last status when the rule finds no data.
            - enum:
                - emit
              type: string
              description: Not accepted when creating or updating rules. Do not send this value.
            - enum:
                - recover
              type: string
              description: Marks the alert `inactive` the first time the rule finds no data for the alert.
            - enum:
                - none
              type: string
              description: Ignores runs where the rule finds no data.
          description: 'How the rule behaves when it finds no data for a group. If omitted, the existing value is kept. Set to `null` to clear it (those runs are then ignored). If you set `last_known_status` or `recover`, a standalone query (`query.format: standalone`) must include `query.no_data`. A composed query (`query.format: composed`) uses `query.base` to detect whether data is present. The `emit` value is not accepted when creating or updating rules.'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerting_rule_query'
        recovery_strategy:
          anyOf:
            - enum:
                - no_breach
              type: string
              description: Recovers an alert when the breach query no longer returns matches.
            - enum:
                - query
              type: string
              description: Recovers an alert when a separate recovery query matches. Requires `query.recovery`.
            - enum:
                - none
              type: string
              description: 'The rule never marks an alert as `recovered`, even after the breach query stops returning matches.'
          description: 'The condition that marks an alert recovered. If omitted, the existing value is kept. Set to `null` to clear it (recovery is then disabled). Set to `no_breach` to recover when the breach query stops returning matches. Set to `query` only when you also provide `query.recovery`. With `none`, the alert stays `active`, even after the breach query stops returning matches. `state_transition.recovering_count` and `recovering_timeframe` require an explicit `recovery_strategy` other than `none`.'
        schedule:
          type:
            - 'null'
            - object
          properties:
            every:
              maxLength: 32
              type: string
              description: 'Execution interval, e.g. 1m, 5m, 1h.'
            lookback:
              maxLength: 32
              type: string
              description: 'Lookback window for the query, e.g. 5m, 1h. Can also be expressed in ES|QL.'
          additionalProperties: false
        state_transition:
          anyOf:
            - type: object
              properties:
                pending_count:
                  maximum: 1000
                  minimum: 0
                  type: integer
                  description: Number of consecutive matches required before the alert becomes `active`.
                pending_operator:
                  enum:
                    - AND
                    - OR
                  type: string
                  description: The operator that combines `pending_count` and `pending_timeframe`. `AND` requires both. `OR` requires either.
                pending_timeframe:
                  maxLength: 32
                  type: string
                  description: 'Time window used with `pending_count`, for example `5m` or `15m`.'
                recovering_count:
                  maximum: 1000
                  minimum: 0
                  type: integer
                  description: Number of consecutive recoveries required before the alert becomes `inactive`.
                recovering_operator:
                  enum:
                    - AND
                    - OR
                  type: string
                  description: The operator that combines `recovering_count` and `recovering_timeframe`. `AND` requires both. `OR` requires either.
                recovering_timeframe:
                  maxLength: 32
                  type: string
                  description: 'Time window used with `recovering_count`, for example `5m` or `15m`.'
              additionalProperties: false
              description: Consecutive-match or time requirements before an alert becomes `active` or `inactive`. Applies only when `kind` is `alert`.
            - { }
        time_field:
          maxLength: 128
          minLength: 1
          type: string
          description: 'Document field used as the event time when applying the lookback window. If omitted, the existing value is kept.'
        version:
          maxLength: 256
          minLength: 1
          type: string
          description: 'The current version of the rule, used for optimistic concurrency control.'
      additionalProperties: false
    Kibana_HTTP_APIs_alerting_workflow_action_policy_destination:
      required:
        - type
        - id
      type: object
      properties:
        id:
          maxLength: 150
          minLength: 1
          type: string
          description: The workflow connector identifier.
        type:
          enum:
            - workflow
          type: string
          description: The destination type.
      additionalProperties: false
    Kibana_HTTP_APIs_alerts_filter_query:
      title: alerts_filter_query
      required:
        - kql
        - filters
      type: object
      properties:
        dsl:
          type: string
          description: A filter written in Elasticsearch Query Domain Specific Language (DSL).
        filters:
          type: array
          items:
            required:
              - meta
            type: object
            properties:
              $state:
                required:
                  - store
                type: object
                properties:
                  store:
                    enum:
                      - appState
                      - globalState
                    type: string
                    description: A filter that can be applied to a specific application context or applied globally.
                additionalProperties: false
              meta:
                type: object
                additionalProperties:
                  description: 'An object with fields such as "controlledBy", "disabled", "field", "group", "index", "isMultiIndex", "key", "negate", "params",  "type", "value"'
              query:
                type: object
                additionalProperties:
                  description: A query for the filter.
            additionalProperties: false
          description: A filter written in Elasticsearch Query Domain Specific Language (DSL) as defined in the `kbn-es-query` package.
        kql:
          type: string
          description: A filter written in Kibana Query Language (KQL).
      additionalProperties: false
    Kibana_HTTP_APIs_apm-anomaly-create-rule-body-alerting:
      title: APM anomaly
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: APM Anomaly Rule Params
          required:
            - windowSize
            - windowUnit
            - environment
            - anomalySeverityType
          type: object
          properties:
            anomalyDetectorTypes:
              minItems: 1
              type: array
              items:
                enum:
                  - txLatency
                  - txThroughput
                  - txFailureRate
                  - txLowCount
                type: string
              description: 'The types of anomalies that are detected. For example, detect abnormal latency, throughput, failed transaction rates, or low transaction count.'
            anomalySeverityType:
              enum:
                - critical
                - major
                - minor
                - warning
              type: string
              description: 'The severity of anomalies that result in an alert: critical, major, minor, or warning.'
            environment:
              type: string
              description: The environment from APM.
            serviceName:
              type: string
              description: The service name from APM.
            transactionType:
              type: string
              description: The transaction type from APM.
            windowSize:
              type: number
              description: 'The size of the time window (in `windowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
            windowUnit:
              type: string
              description: 'The type of units for the time window: minutes, hours, or days.'
          additionalProperties: false
          description: The parameters for the APM anomaly rule. These parameters are appropriate when `rule_type_id` is `apm.anomaly"`.
        rule_type_id:
          enum:
            - apm.anomaly
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_apm-error-rate-create-rule-body-alerting:
      title: Error rate
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Error Count Rule Params
          required:
            - windowSize
            - windowUnit
            - threshold
            - environment
          type: object
          properties:
            environment:
              type: string
              description: Filter the errors coming from your application to apply the rule to a specific environment.
            errorGroupingKey:
              type: string
              description: 'Filter the errors coming from your application to apply the rule to a specific error grouping key, which is a hash of the stack trace and other properties.'
            groupBy:
              type: array
              items:
                type: string
                description: 'Perform a composite aggregation against the selected fields. When any of these groups match the selected rule conditions, an alert is triggered per group.'
            searchConfiguration:
              required:
                - query
              type: object
              properties:
                query:
                  required:
                    - query
                    - language
                  type: object
                  properties:
                    language:
                      type: string
                    query:
                      anyOf:
                        - type: string
                        - type: object
                          additionalProperties: { }
                  additionalProperties: false
              additionalProperties: false
            serviceName:
              type: string
              description: Filter the errors coming from your application to apply the rule to a specific service.
            threshold:
              type: number
              description: 'The number of errors, which is the threshold for alerts.'
            useKqlFilter:
              type: boolean
              description: A filter in Kibana Query Language (KQL) that limits the scope of the rule.
            windowSize:
              type: number
              description: The time frame in which the errors must occur (in `windowUnit` units). Generally it should be a value higher than the rule check interval to avoid gaps in detection.
            windowUnit:
              type: string
              description: 'The type of units for the time window: minutes, hours, or days.'
          additionalProperties: false
          description: The parameters for the error count rule. These parameters are appropriate when `rule_type_id` is `apm.error_rate`.
        rule_type_id:
          enum:
            - apm.error_rate
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_apm-service-map-embeddable:
      type: object
      properties:
        alert_status_filter:
          maxItems: 4
          type: array
          items:
            enum:
              - active
              - recovered
              - untracked
              - delayed
            type: string
        anomaly_severity_filter:
          maxItems: 6
          type: array
          items:
            enum:
              - critical
              - major
              - minor
              - warning
              - low
              - unknown
            type: string
        connection_filter:
          maxItems: 2
          type: array
          items:
            enum:
              - orphaned
              - connected
            type: string
        description:
          type: string
          description: A short description of the panel.
        environment:
          maxLength: 1024
          type: string
          default: ENVIRONMENT_ALL
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        highlighted_service_names:
          maxItems: 50
          type: array
          items:
            maxLength: 1024
            type: string
        kuery:
          maxLength: 2048
          type: string
        map_orientation:
          enum:
            - horizontal
            - vertical
          type: string
        service_group_id:
          maxLength: 1024
          type: string
        service_name:
          maxLength: 1024
          type: string
        slo_status_filter:
          maxItems: 4
          type: array
          items:
            enum:
              - healthy
              - degrading
              - violated
              - noData
            type: string
        sync_with_dashboard_filters:
          type: boolean
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: APM service map embeddable schema
    Kibana_HTTP_APIs_apm-transaction-duration-create-rule-body-alerting:
      title: Transaction duration
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Transaction Duration Rule Params
          required:
            - windowSize
            - windowUnit
            - threshold
            - aggregationType
            - environment
          type: object
          properties:
            aggregationType:
              enum:
                - avg
                - 95th
                - 99th
              type: string
              description: The type of aggregation to perform.
            environment:
              type: string
              description: Filter the rule to apply to a specific environment.
            groupBy:
              type: array
              items:
                type: string
                description: 'Perform a composite aggregation against the selected fields. When any of these groups match the selected rule conditions, an alert is triggered per group.'
            searchConfiguration:
              required:
                - query
              type: object
              properties:
                query:
                  required:
                    - query
                    - language
                  type: object
                  properties:
                    language:
                      type: string
                    query:
                      anyOf:
                        - type: string
                        - type: object
                          additionalProperties: { }
                  additionalProperties: false
              additionalProperties: false
            serviceName:
              type: string
              description: Filter the rule to apply to a specific service.
            threshold:
              type: number
              description: The latency threshold value.
            transactionName:
              type: string
              description: Filter the rule to apply to a specific transaction name.
            transactionType:
              type: string
              description: Filter the rule to apply to a specific transaction type.
            useKqlFilter:
              type: boolean
              description: A Kibana Query Language (KQL) expression thats limits the scope of alerts.
            windowSize:
              type: number
              description: 'The size of the time window (in `windowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
            windowUnit:
              type: string
              description: 'The type of units for the time window. For example: minutes, hours, or days.'
          additionalProperties: false
          description: The parameters for the transaction duration rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_duration`.
        rule_type_id:
          enum:
            - apm.transaction_duration
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_apm-transaction-error-rate-create-rule-body-alerting:
      title: Transaction error rate
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Transaction Error Rate Rule Params
          required:
            - windowSize
            - windowUnit
            - threshold
            - environment
          type: object
          properties:
            environment:
              type: string
            groupBy:
              type: array
              items:
                type: string
            searchConfiguration:
              required:
                - query
              type: object
              properties:
                query:
                  required:
                    - query
                    - language
                  type: object
                  properties:
                    language:
                      type: string
                    query:
                      anyOf:
                        - type: string
                        - type: object
                          additionalProperties: { }
                  additionalProperties: false
              additionalProperties: false
            serviceName:
              type: string
            threshold:
              type: number
            transactionName:
              type: string
            transactionType:
              type: string
            useKqlFilter:
              type: boolean
            windowSize:
              type: number
            windowUnit:
              type: string
          additionalProperties: false
          description: The parameters for the transaction error rate rule. These parameters are appropriate when `rule_type_id` is `apm.transaction_error_rate`.
        rule_type_id:
          enum:
            - apm.transaction_error_rate
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_backfill_error_response:
      title: backfill_error_response
      required:
        - error
      type: object
      properties:
        error:
          required:
            - message
            - rule
          type: object
          properties:
            message:
              type: string
            rule:
              required:
                - id
              type: object
              properties:
                id:
                  type: string
                name:
                  type: string
              additionalProperties: false
            status:
              type: number
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_backfill_response:
      title: backfill_response
      required:
        - id
        - created_at
        - duration
        - enabled
        - rule
        - space_id
        - initiator
        - start
        - status
        - schedule
      type: object
      properties:
        created_at:
          type: string
        duration:
          type: string
        enabled:
          type: boolean
        end:
          type: string
        id:
          type: string
        initiator:
          enum:
            - user
            - system
          type: string
        initiator_id:
          type: string
        rule:
          required:
            - id
            - name
            - tags
            - rule_type_id
            - params
            - consumer
            - enabled
            - schedule
            - created_at
            - updated_at
            - revision
          type: object
          properties:
            api_key_created_by_user:
              type:
                - 'null'
                - boolean
            api_key_owner:
              type:
                - 'null'
                - string
              default: 'null'
            consumer:
              type: string
            created_at:
              type: string
            created_by:
              type:
                - 'null'
                - string
              default: 'null'
            enabled:
              type: boolean
            id:
              type: string
            name:
              type: string
            params:
              type: object
              additionalProperties: { }
              description: The parameters for the rule.
            revision:
              type: number
            rule_type_id:
              type: string
            schedule:
              required:
                - interval
              type: object
              properties:
                interval:
                  type: string
              additionalProperties: false
            tags:
              type: array
              items:
                type: string
            updated_at:
              type: string
            updated_by:
              type:
                - 'null'
                - string
              default: 'null'
          additionalProperties: false
        schedule:
          type: array
          items:
            required:
              - run_at
              - status
              - interval
            type: object
            properties:
              interval:
                type: string
              run_at:
                type: string
              status:
                enum:
                  - complete
                  - pending
                  - running
                  - error
                  - timeout
                type: string
            additionalProperties: false
        space_id:
          type: string
        start:
          type: string
        status:
          enum:
            - complete
            - pending
            - running
            - error
            - timeout
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_request:
      title: bulk_delete_enrollment_api_keys_request
      type: object
      properties:
        forceDelete:
          type: boolean
          description: 'When false (default), invalidate the API key and mark the token as inactive. When true, also delete the token document.'
          default: false
        includeHidden:
          type: boolean
          description: 'When true, allow deletion of hidden enrollment tokens (managed/agentless policies). Defaults to false.'
          default: false
        kuery:
          type: string
          description: KQL query to select enrollment tokens to delete.
        tokenIds:
          maxItems: 10000
          type: array
          items:
            type: string
          description: List of enrollment token IDs to delete.
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_delete_enrollment_api_keys_response:
      title: bulk_delete_enrollment_api_keys_response
      required:
        - action
        - count
        - successCount
        - errorCount
      type: object
      properties:
        action:
          type: string
        count:
          type: number
        errorCount:
          type: number
        successCount:
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_get_agent_policies_response:
      title: bulk_get_agent_policies_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_agent_policy_response'
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_get_package_policies_response:
      title: bulk_get_package_policies_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_install_packages_from_registry_request:
      title: bulk_install_packages_from_registry_request
      required:
        - packages
      type: object
      properties:
        allow_outdated_version:
          type: boolean
          description: 'When true, allow installing a version older than the latest available. Bypasses only the out-of-date version check.'
          default: false
        force:
          type: boolean
          default: false
        packages:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            anyOf:
              - type: string
              - required:
                  - name
                  - version
                type: object
                properties:
                  name:
                    type: string
                  prerelease:
                    type: boolean
                  version:
                    type: string
                additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_install_packages_from_registry_response:
      title: bulk_install_packages_from_registry_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_response_item_success'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_bulk_install_packages_response_item_error'
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_install_packages_response_item_error:
      title: bulk_install_packages_response_item_error
      required:
        - name
        - statusCode
      type: object
      properties:
        error:
          anyOf:
            - type: string
            - { }
        name:
          type: string
        statusCode:
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_install_packages_response_item_success:
      title: bulk_install_packages_response_item_success
      required:
        - name
        - version
        - result
      type: object
      properties:
        name:
          type: string
        result:
          required:
            - error
            - installType
          type: object
          properties:
            assets:
              maxItems: 10000
              type: array
              items:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kibana_asset_reference'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_es_asset_reference'
            error: { }
            installSource:
              type: string
            installType:
              type: string
            status:
              enum:
                - installed
                - already_installed
              type: string
          additionalProperties: false
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_namespace_customization_request:
      title: bulk_namespace_customization_request
      required:
        - packages
      type: object
      properties:
        disable:
          maxItems: 100
          type: array
          items:
            type: string
          description: Namespaces to disable namespace-level customization for on each package.
        enable:
          maxItems: 100
          type: array
          items:
            type: string
          description: Namespaces to enable namespace-level customization for on each package.
        packages:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            type: string
          description: Package names to apply the customization changes to.
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_namespace_customization_response:
      title: bulk_namespace_customization_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 1000
          type: array
          items:
            required:
              - name
              - success
            type: object
            properties:
              error:
                type: string
              name:
                type: string
              namespace_customization_enabled_for:
                maxItems: 100
                type: array
                items:
                  type: string
                description: 'The opt-in list on the package. Returned whenever the package is installed: the new list on success, or the unchanged list when the request is rejected (for example, because of a namespace-prefix restriction).'
              success:
                type: boolean
              warnings:
                maxItems: 100
                type: array
                items:
                  required:
                    - dataStreamName
                    - namespace
                    - baseTemplateName
                    - nsTemplateName
                    - conflictingTemplates
                  type: object
                  properties:
                    baseTemplateName:
                      maxLength: 1000
                      type: string
                    conflictingTemplates:
                      maxItems: 100
                      type: array
                      items:
                        required:
                          - name
                          - priority
                          - conflictType
                        type: object
                        properties:
                          conflictType:
                            enum:
                              - overrides_fleet
                              - blocked_by_same_priority
                              - overridden_by_fleet
                            type: string
                          name:
                            maxLength: 1000
                            type: string
                          priority:
                            type: number
                        additionalProperties: false
                    dataStreamName:
                      maxLength: 1000
                      type: string
                    namespace:
                      maxLength: 255
                      type: string
                    nsTemplateName:
                      maxLength: 1000
                      type: string
                  additionalProperties: false
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_rollback_packages_request:
      title: bulk_rollback_packages_request
      required:
        - packages
      type: object
      properties:
        packages:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            required:
              - name
            type: object
            properties:
              name:
                type: string
                description: Package name to rollback
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_rollback_packages_response:
      title: bulk_rollback_packages_response
      required:
        - taskId
      type: object
      properties:
        taskId:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_uninstall_packages_request:
      title: bulk_uninstall_packages_request
      required:
        - packages
      type: object
      properties:
        force:
          type: boolean
          default: false
        packages:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            required:
              - name
              - version
            type: object
            properties:
              name:
                type: string
              version:
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_upgrade_managed_integration_result:
      title: bulk_upgrade_managed_integration_result
      required:
        - id
        - success
      type: object
      properties:
        body:
          required:
            - message
          type: object
          properties:
            message:
              maxLength: 4096
              type: string
              description: Error message when the upgrade failed for this policy.
          additionalProperties: false
        id:
          maxLength: 256
          type: string
          description: The ID of the managed integration.
        name:
          maxLength: 256
          type: string
          description: The name of the managed integration.
        statusCode:
          type: number
          description: HTTP-like status code when the upgrade failed for this policy.
        success:
          type: boolean
          description: Whether the policy's saved object was upgraded successfully. The live workload is reconciled asynchronously in the background.
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_upgrade_managed_integrations_request:
      title: bulk_upgrade_managed_integrations_request
      required:
        - policyIds
      type: object
      properties:
        policyIds:
          maxItems: 1000
          type: array
          items:
            maxLength: 256
            type: string
          description: IDs of the managed integrations to upgrade to their installed package version.
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_upgrade_packages_request:
      title: bulk_upgrade_packages_request
      required:
        - packages
      type: object
      properties:
        force:
          type: boolean
          default: false
        packages:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            required:
              - name
            type: object
            properties:
              name:
                type: string
              version:
                type: string
            additionalProperties: false
        prerelease:
          type: boolean
        upgrade_package_policies:
          type: boolean
          default: false
      additionalProperties: false
    Kibana_HTTP_APIs_bulk_upgrade_packages_response:
      title: bulk_upgrade_packages_response
      required:
        - taskId
      type: object
      properties:
        taskId:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_category_summary_item:
      title: category_summary_item
      required:
        - id
        - title
        - count
      type: object
      properties:
        count:
          type: number
        id:
          type: string
        parent_id:
          type: string
        parent_title:
          type: string
        title:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_ClassicFieldDefinition:
      type: object
      additionalProperties:
        $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinitionConfig'
    Kibana_HTTP_APIs_ClassicFieldDefinitionConfig:
      allOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
        - anyOf:
            - required:
                - type
              type: object
              properties:
                description:
                  type: string
                format:
                  minLength: 1
                  type: string
                  description: A non-empty string.
                type:
                  enum:
                    - keyword
                    - match_only_text
                    - long
                    - double
                    - date
                    - boolean
                    - ip
                    - geo_point
                    - integer
                    - short
                    - byte
                    - float
                    - half_float
                    - text
                    - wildcard
                    - version
                    - unsigned_long
                    - date_nanos
                  type: string
              additionalProperties: false
            - required:
                - type
              type: object
              properties:
                description:
                  type: string
                type:
                  enum:
                    - system
                  type: string
              additionalProperties: false
    Kibana_HTTP_APIs_ClassicStreamUpsertRequest:
      required:
        - dashboards
        - rules
        - stream
      type: object
      properties:
        dashboards:
          type: array
          items:
            type: string
        rules:
          type: array
          items:
            type: string
        stream:
          required:
            - description
            - ingest
            - type
          type: object
          properties:
            description:
              type: string
            ingest:
              required:
                - lifecycle
                - processing
                - settings
                - failure_store
                - classic
              type: object
              properties:
                classic:
                  type: object
                  properties:
                    field_overrides:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicFieldDefinition'
                  additionalProperties: false
                failure_store:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                lifecycle:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                processing:
                  anyOf:
                    - required:
                        - steps
                      type: object
                      properties:
                        steps:
                          type: array
                          items:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                      additionalProperties: false
                    - required:
                        - processors
                      type: object
                      properties:
                        processors:
                          type: array
                          items:
                            type: object
                            additionalProperties: { }
                      additionalProperties: false
                settings:
                  type: object
                  properties:
                    index.number_of_replicas:
                      required:
                        - value
                      type: object
                      properties:
                        value:
                          type: number
                      additionalProperties: false
                    index.number_of_shards:
                      required:
                        - value
                      type: object
                      properties:
                        value:
                          type: number
                      additionalProperties: false
                    index.refresh_interval:
                      required:
                        - value
                      type: object
                      properties:
                        value:
                          anyOf:
                            - type: string
                            - enum:
                                - -1
                              type: number
                      additionalProperties: false
                  additionalProperties: false
              additionalProperties: false
            query_streams:
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
            type:
              enum:
                - classic
              type: string
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_Condition:
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_FilterCondition'
        - required:
            - and
          type: object
          properties:
            and:
              type: array
              items:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: An array of conditions. All sub-conditions must be true for this condition to be true.
          additionalProperties: false
          description: A logical AND that groups multiple conditions.
        - required:
            - or
          type: object
          properties:
            or:
              type: array
              items:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              description: An array of conditions. At least one sub-condition must be true for this condition to be true.
          additionalProperties: false
          description: A logical OR that groups multiple conditions.
        - required:
            - not
          type: object
          properties:
            not:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
          additionalProperties: false
          description: A logical NOT that negates a condition.
        - required:
            - never
          type: object
          properties:
            never:
              type: object
              additionalProperties: false
              description: An empty object. This condition never matches.
          additionalProperties: false
          description: A condition that always evaluates to false.
        - required:
            - always
          type: object
          properties:
            always:
              type: object
              additionalProperties: false
              description: An empty object. This condition always matches.
          additionalProperties: false
          description: 'A condition that always evaluates to true. Useful for catch-all scenarios, but use with caution as partitions are ordered.'
      description: The root condition object. It can be a simple filter or a combination of other conditions.
    Kibana_HTTP_APIs_ConditionWithSteps:
      allOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
        - required:
            - steps
          type: object
          properties:
            else:
              type: array
              items:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
            steps:
              type: array
              items:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
          additionalProperties: false
    Kibana_HTTP_APIs_connector_execute_request:
      title: connector_execute_request
      required:
        - params
      type: object
      properties:
        params:
          oneOf:
            - $ref: '#/components/schemas/run_acknowledge_resolve_pagerduty'
            - $ref: '#/components/schemas/run_documents'
            - $ref: '#/components/schemas/run_message_email'
            - $ref: '#/components/schemas/run_message_serverlog'
            - $ref: '#/components/schemas/run_message_slack'
            - $ref: '#/components/schemas/run_trigger_pagerduty'
            - $ref: '#/components/schemas/run_addevent'
            - $ref: '#/components/schemas/run_closealert'
            - $ref: '#/components/schemas/run_closeincident'
            - $ref: '#/components/schemas/run_createalert'
            - $ref: '#/components/schemas/run_fieldsbyissuetype'
            - $ref: '#/components/schemas/run_getagentdetails'
            - $ref: '#/components/schemas/run_getagents'
            - $ref: '#/components/schemas/run_getchoices'
            - $ref: '#/components/schemas/run_getfields'
            - $ref: '#/components/schemas/run_getincident'
            - $ref: '#/components/schemas/run_issue'
            - $ref: '#/components/schemas/run_issues'
            - $ref: '#/components/schemas/run_issuetypes'
            - $ref: '#/components/schemas/run_postmessage'
            - $ref: '#/components/schemas/run_pushtoservice'
            - $ref: '#/components/schemas/run_validchannelid'
          additionalProperties: { }
      additionalProperties: false
    Kibana_HTTP_APIs_connector_response:
      title: connector_response
      required:
        - id
        - name
        - connector_type_id
        - is_preconfigured
        - is_deprecated
        - is_system_action
        - is_connector_type_deprecated
      type: object
      properties:
        auth_mode:
          enum:
            - shared
            - per-user
          type: string
          description: The authentication mode used for the connector.
        config:
          type: object
          additionalProperties: { }
        connector_type_id:
          type: string
          description: The connector type identifier.
        id:
          type: string
          description: The identifier for the connector.
        is_connector_type_deprecated:
          type: boolean
          description: Indicates whether the connector type is deprecated.
        is_deprecated:
          type: boolean
          description: Indicates whether the connector is deprecated.
        is_missing_secrets:
          type: boolean
          description: Indicates whether the connector is missing secrets.
        is_preconfigured:
          type: boolean
          description: 'Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. '
        is_system_action:
          type: boolean
          description: Indicates whether the connector is used for system actions.
        name:
          type: string
          description: ' The name of the connector.'
      additionalProperties: false
    Kibana_HTTP_APIs_connector_response_with_references_count:
      title: connector_response_with_references_count
      required:
        - id
        - name
        - connector_type_id
        - is_preconfigured
        - is_deprecated
        - is_system_action
        - is_connector_type_deprecated
        - referenced_by_count
      type: object
      properties:
        auth_mode:
          enum:
            - shared
            - per-user
          type: string
          description: The authentication mode used for the connector.
        config:
          type: object
          additionalProperties: { }
        connector_type_id:
          type: string
          description: The connector type identifier.
        id:
          type: string
          description: The identifier for the connector.
        is_connector_type_deprecated:
          type: boolean
          description: Indicates whether the connector type is deprecated.
        is_deprecated:
          type: boolean
          description: Indicates whether the connector is deprecated.
        is_missing_secrets:
          type: boolean
          description: Indicates whether the connector is missing secrets.
        is_preconfigured:
          type: boolean
          description: 'Indicates whether the connector is preconfigured. If true, the `config` and `is_missing_secrets` properties are omitted from the response. '
        is_system_action:
          type: boolean
          description: Indicates whether the connector is used for system actions.
        name:
          type: string
          description: ' The name of the connector.'
        referenced_by_count:
          type: number
          description: 'The number of saved objects that reference the connector. If is_preconfigured is true, this value is not calculated.'
      additionalProperties: false
    Kibana_HTTP_APIs_connector_type_response:
      title: connector_type_response
      required:
        - id
        - name
        - enabled
        - enabled_in_config
        - enabled_in_license
        - minimum_license_required
        - supported_feature_ids
        - is_system_action_type
        - is_deprecated
        - source
        - is_testable
      type: object
      properties:
        allow_multiple_system_actions:
          type: boolean
          description: Indicates whether multiple instances of the same system action connector can be used in a single rule.
        description:
          type: string
          description: Description of the connector type.
        enabled:
          type: boolean
          description: Indicates whether the connector is enabled.
        enabled_in_config:
          type: boolean
          description: Indicates whether the connector is enabled in the Kibana configuration.
        enabled_in_license:
          type: boolean
          description: Indicates whether the connector is enabled through the license.
        id:
          type: string
          description: The identifier for the connector.
        is_deprecated:
          type: boolean
          description: Indicates whether the connector type is deprecated.
        is_experimental:
          type: boolean
          description: Indicates whether the connector type is in technical preview.
        is_system_action_type:
          type: boolean
          description: Indicates whether the action is a system action.
        is_testable:
          type: boolean
          description: Indicates whether the connector type supports testing.
        minimum_license_required:
          enum:
            - basic
            - standard
            - gold
            - platinum
            - enterprise
            - trial
          type: string
          description: The minimum license required to enable the connector.
        name:
          type: string
          description: The name of the connector type.
        source:
          enum:
            - yml
            - spec
            - stack
          type: string
          description: The source of the connector type definition.
        sub_feature:
          enum:
            - endpointSecurity
          type: string
          description: Indicates the sub-feature type the connector is grouped under.
        supported_feature_ids:
          type: array
          items:
            type: string
          description: The list of supported features
      additionalProperties: false
    Kibana_HTTP_APIs_copy_agent_policy_request:
      title: copy_agent_policy_request
      required:
        - name
      type: object
      properties:
        description:
          type: string
        name:
          minLength: 1
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_core_status_redactedResponse:
      title: core_status_redactedResponse
      required:
        - status
      type: object
      properties:
        status:
          required:
            - overall
          type: object
          properties:
            overall:
              required:
                - level
              type: object
              properties:
                level:
                  enum:
                    - available
                    - degraded
                    - unavailable
                    - critical
                  type: string
                  description: Service status levels as human and machine readable values.
              additionalProperties: false
          additionalProperties: false
      additionalProperties: false
      description: A minimal representation of Kibana's operational status. Returned when the caller is unauthenticated or lacks the `monitor` cluster privilege.
    Kibana_HTTP_APIs_core_status_response:
      title: core_status_response
      required:
        - name
        - uuid
        - version
        - status
        - metrics
      type: object
      properties:
        metrics:
          required:
            - elasticsearch_client
            - last_updated
            - collection_interval_in_millis
          type: object
          properties:
            collection_interval_in_millis:
              type: number
              description: The interval at which metrics should be collected.
            elasticsearch_client:
              required:
                - totalActiveSockets
                - totalIdleSockets
                - totalQueuedRequests
              type: object
              properties:
                totalActiveSockets:
                  type: number
                  description: Count of network sockets currently in use.
                totalIdleSockets:
                  type: number
                  description: Count of network sockets currently idle.
                totalQueuedRequests:
                  type: number
                  description: Count of requests not yet assigned to sockets.
              additionalProperties: false
              description: Current network metrics of Kibana's Elasticsearch client.
            last_updated:
              type: string
              description: The time metrics were collected.
          additionalProperties: false
          description: Metric groups collected by Kibana.
        name:
          type: string
          description: Kibana instance name.
        status:
          required:
            - overall
            - core
            - plugins
          type: object
          properties:
            core:
              required:
                - elasticsearch
                - savedObjects
              type: object
              properties:
                elasticsearch:
                  required:
                    - level
                    - summary
                    - meta
                  type: object
                  properties:
                    detail:
                      type: string
                      description: Human readable detail of the service status.
                    documentationUrl:
                      type: string
                      description: A URL to further documentation regarding this service.
                    level:
                      enum:
                        - available
                        - degraded
                        - unavailable
                        - critical
                      type: string
                      description: Service status levels as human and machine readable values.
                    meta:
                      type: object
                      additionalProperties: { }
                      description: An unstructured set of extra metadata about this service.
                    summary:
                      type: string
                      description: A human readable summary of the service status.
                  additionalProperties: false
                http:
                  required:
                    - level
                    - summary
                    - meta
                  type: object
                  properties:
                    detail:
                      type: string
                      description: Human readable detail of the service status.
                    documentationUrl:
                      type: string
                      description: A URL to further documentation regarding this service.
                    level:
                      enum:
                        - available
                        - degraded
                        - unavailable
                        - critical
                      type: string
                      description: Service status levels as human and machine readable values.
                    meta:
                      type: object
                      additionalProperties: { }
                      description: An unstructured set of extra metadata about this service.
                    summary:
                      type: string
                      description: A human readable summary of the service status.
                  additionalProperties: false
                savedObjects:
                  required:
                    - level
                    - summary
                    - meta
                  type: object
                  properties:
                    detail:
                      type: string
                      description: Human readable detail of the service status.
                    documentationUrl:
                      type: string
                      description: A URL to further documentation regarding this service.
                    level:
                      enum:
                        - available
                        - degraded
                        - unavailable
                        - critical
                      type: string
                      description: Service status levels as human and machine readable values.
                    meta:
                      type: object
                      additionalProperties: { }
                      description: An unstructured set of extra metadata about this service.
                    summary:
                      type: string
                      description: A human readable summary of the service status.
                  additionalProperties: false
              additionalProperties: false
              description: Statuses of core Kibana services.
            overall:
              required:
                - level
                - summary
                - meta
              type: object
              properties:
                detail:
                  type: string
                  description: Human readable detail of the service status.
                documentationUrl:
                  type: string
                  description: A URL to further documentation regarding this service.
                level:
                  enum:
                    - available
                    - degraded
                    - unavailable
                    - critical
                  type: string
                  description: Service status levels as human and machine readable values.
                meta:
                  type: object
                  additionalProperties: { }
                  description: An unstructured set of extra metadata about this service.
                summary:
                  type: string
                  description: A human readable summary of the service status.
              additionalProperties: false
            plugins:
              type: object
              additionalProperties:
                required:
                  - level
                  - summary
                  - meta
                type: object
                properties:
                  detail:
                    type: string
                    description: Human readable detail of the service status.
                  documentationUrl:
                    type: string
                    description: A URL to further documentation regarding this service.
                  level:
                    enum:
                      - available
                      - degraded
                      - unavailable
                      - critical
                    type: string
                    description: Service status levels as human and machine readable values.
                  meta:
                    type: object
                    additionalProperties: { }
                    description: An unstructured set of extra metadata about this service.
                  summary:
                    type: string
                    description: A human readable summary of the service status.
                additionalProperties: false
              description: A dynamic mapping of plugin ID to plugin status.
          additionalProperties: false
        uuid:
          type: string
          description: 'Unique, generated Kibana instance UUID. This UUID should persist even if the Kibana process restarts.'
        version:
          required:
            - number
            - build_hash
            - build_number
            - build_snapshot
            - build_flavor
            - build_date
          type: object
          properties:
            build_date:
              type: string
              description: The date and time of this build.
            build_flavor:
              enum:
                - serverless
                - traditional
              type: string
              description: 'The build flavour determines configuration and behavior of Kibana. On premise users will almost always run the "traditional" flavour, while other flavours are reserved for Elastic-specific use cases.'
            build_hash:
              type: string
              description: A unique hash value representing the git commit of this Kibana build.
            build_number:
              type: number
              description: 'A monotonically increasing number, each subsequent build will have a higher number.'
            build_snapshot:
              type: boolean
              description: Whether this build is a snapshot build.
            number:
              type: string
              description: A semantic version number.
          additionalProperties: false
      additionalProperties: false
      description: Kibana's operational status as well as a detailed breakdown of plugin statuses indication of various loads (like event loop utilization and network traffic) at time of request.
    Kibana_HTTP_APIs_create_custom_integration_request:
      title: create_custom_integration_request
      required:
        - integrationName
        - datasets
      type: object
      properties:
        datasets:
          maxItems: 10
          type: array
          items:
            required:
              - name
              - type
            type: object
            properties:
              name:
                type: string
              type:
                enum:
                  - logs
                  - metrics
                  - traces
                  - synthetics
                  - profiles
                type: string
            additionalProperties: false
        force:
          type: boolean
        integrationName:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_create_enrollment_api_key_response:
      title: create_enrollment_api_key_response
      required:
        - item
        - action
      type: object
      properties:
        action:
          enum:
            - created
          type: string
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key'
      additionalProperties: false
    Kibana_HTTP_APIs_create_managed_integration_request:
      title: create_managed_integration_request
      required:
        - name
        - package
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            maxLength: 256
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        cloud_connector:
          type:
            - 'null'
            - object
          properties:
            cloud_connector_id:
              maxLength: 256
              type: string
              description: 'ID of an existing cloud connector to reuse. If not provided, a new connector is created. Requires `enabled: true` and cannot be combined with `name`.'
            enabled:
              type: boolean
              description: 'Set to `true` to attach a cloud connector to this policy. Must be `true` to set any of `cloud_connector_id`, `name`, or `target_csp`.'
              default: false
            name:
              maxLength: 255
              minLength: 1
              type: string
              description: 'Name for a new cloud connector. If not provided, a name is generated automatically from the credentials. Requires `enabled: true` and only applies when creating a new connector (cannot be combined with `cloud_connector_id`).'
            target_csp:
              enum:
                - aws
                - azure
                - gcp
              type: string
              description: 'Target cloud service provider. If not provided, the provider is detected automatically from the inputs. Requires `enabled: true`.'
          additionalProperties: false
        create_dataset_templates:
          type: boolean
          description: 'When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.'
        description:
          maxLength: 2048
          type: string
          description: Policy description.
        force:
          type: boolean
          description: 'Force package policy creation even if the package is not verified, or if the agent policy is managed.'
        global_data_tags:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                maxLength: 1024
                type: string
                description: Name of the custom field. The name cannot contain spaces.
              value:
                anyOf:
                  - maxLength: 1024
                    type: string
                  - type: number
                description: Value of the custom field.
            additionalProperties: false
        id:
          maxLength: 255
          type: string
          description: Policy unique identifier.
        inputs:
          type: object
          additionalProperties:
            type: object
            properties:
              condition:
                maxLength: 10000
                type:
                  - 'null'
                  - string
                description: Agent condition expression to evaluate whether to apply this input.
              deprecated:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info'
              enabled:
                type: boolean
                description: Enable or disable that input. Defaults to `true` (enabled).
              streams:
                type: object
                additionalProperties:
                  type: object
                  properties:
                    condition:
                      maxLength: 10000
                      type:
                        - 'null'
                        - string
                      description: Agent condition expression to evaluate whether to apply this stream.
                    deprecated:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info'
                    enabled:
                      type: boolean
                      description: Enable or disable that stream. Defaults to `true` (enabled).
                    var_group_selections:
                      type: object
                      additionalProperties:
                        maxLength: 1024
                        type: string
                      description: Variable group selections. Maps var_group name to the selected option name within that group.
                    vars:
                      type: object
                      additionalProperties:
                        anyOf:
                          - maxLength: 10000
                            type: string
                          - type: number
                          - type: boolean
                          - maxItems: 100
                            type: array
                            items:
                              maxLength: 10000
                              type: string
                          - maxItems: 100
                            type: array
                            items:
                              type: number
                          - required:
                              - id
                              - isSecretRef
                            type: object
                            properties:
                              id:
                                maxLength: 255
                                type: string
                              isSecretRef:
                                type: boolean
                            additionalProperties: false
                        default: 'null'
                      description: Input/stream level variable. Refer to the integration documentation for more information.
                  additionalProperties: false
                description: Input streams. Refer to the integration documentation to know which streams are available.
              vars:
                type: object
                additionalProperties:
                  anyOf:
                    - maxLength: 10000
                      type: string
                    - type: number
                    - type: boolean
                    - maxItems: 100
                      type: array
                      items:
                        maxLength: 10000
                        type: string
                    - maxItems: 100
                      type: array
                      items:
                        type: number
                    - required:
                        - id
                        - isSecretRef
                      type: object
                      properties:
                        id:
                          maxLength: 255
                          type: string
                        isSecretRef:
                          type: boolean
                      additionalProperties: false
                  default: 'null'
                description: Input/stream level variable. Refer to the integration documentation for more information.
            additionalProperties: false
          description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
        name:
          maxLength: 255
          type: string
          description: Unique name for the policy.
        namespace:
          maxLength: 100
          type: string
          description: 'Policy namespace. When not specified, it inherits the agent policy namespace.'
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        policy_template:
          maxLength: 256
          type: string
          description: 'The policy template to use for the managed integration. If not provided, the default policy template is used.'
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          type: object
          additionalProperties:
            anyOf:
              - maxLength: 10000
                type: string
              - type: number
              - type: boolean
              - maxItems: 100
                type: array
                items:
                  maxLength: 10000
                  type: string
              - maxItems: 100
                type: array
                items:
                  type: number
              - required:
                  - id
                  - isSecretRef
                type: object
                properties:
                  id:
                    maxLength: 255
                    type: string
                  isSecretRef:
                    type: boolean
                additionalProperties: false
            default: 'null'
          description: Input/stream level variable. Refer to the integration documentation for more information.
      additionalProperties: false
    Kibana_HTTP_APIs_create_package_policy_request:
      title: create_package_policy_request
      required:
        - name
        - inputs
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        cloud_connector_id:
          type:
            - 'null'
            - string
          description: ID of the cloud connector associated with this package policy.
        cloud_connector_name:
          maxLength: 255
          minLength: 1
          type:
            - 'null'
            - string
          description: Transient field for cloud connector name during creation.
        condition:
          maxLength: 10000
          type:
            - 'null'
            - string
          description: Agent condition expression to evaluate whether to apply this integration to its inputs.
        create_dataset_templates:
          type: boolean
          description: 'When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.'
        description:
          type: string
          description: Package policy description
        enabled:
          type: boolean
        force:
          type: boolean
          description: 'Force package policy creation even if the package is not verified, or if the agent policy is managed.'
        global_data_tags:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
                description: The name of the custom field. Cannot contain spaces.
              value:
                type:
                  - number
                  - string
                description: The value of the custom field.
            additionalProperties: false
        id:
          type: string
          description: Package policy unique identifier
        inputs:
          maxItems: 1000
          type: array
          items:
            required:
              - type
              - enabled
            type: object
            properties:
              condition:
                maxLength: 10000
                type:
                  - 'null'
                  - string
                description: Agent condition expression to evaluate whether to apply this input.
              config:
                type: object
                additionalProperties:
                  required:
                    - value
                  type: object
                  properties:
                    frozen:
                      type: boolean
                    type:
                      type: string
                    value: { }
                  additionalProperties: false
                description: Package variable (see integration documentation for more information)
              deprecated:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info'
              enabled:
                type: boolean
              id:
                type: string
              keep_enabled:
                type: boolean
              migrate_from:
                type: string
              name:
                type: string
              policy_template:
                type: string
              streams:
                maxItems: 1000
                type: array
                items:
                  required:
                    - enabled
                    - data_stream
                    - compiled_stream
                  type: object
                  properties:
                    compiled_stream: { }
                    condition:
                      maxLength: 10000
                      type:
                        - 'null'
                        - string
                      description: Agent condition expression to evaluate whether to apply this stream.
                    config:
                      type: object
                      additionalProperties:
                        required:
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            type: string
                          value: { }
                        additionalProperties: false
                      description: Package variable (see integration documentation for more information)
                    data_stream:
                      required:
                        - dataset
                      type: object
                      properties:
                        dataset:
                          type: string
                        elasticsearch:
                          type: object
                          properties:
                            dynamic_dataset:
                              type: boolean
                            dynamic_namespace:
                              type: boolean
                            privileges:
                              type: object
                              properties:
                                indices:
                                  maxItems: 100
                                  type: array
                                  items:
                                    type: string
                              additionalProperties: false
                          additionalProperties: false
                        type:
                          type: string
                      additionalProperties: false
                    deprecated:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info'
                    enabled:
                      type: boolean
                    id:
                      type: string
                    keep_enabled:
                      type: boolean
                    migrate_from:
                      type: string
                    release:
                      enum:
                        - ga
                        - beta
                        - experimental
                      type: string
                    var_group_selections:
                      type: object
                      additionalProperties:
                        maxLength: 1024
                        type: string
                      description: Variable group selections. Maps var_group name to the selected option name within that group.
                    vars:
                      type: object
                      additionalProperties:
                        required:
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            type: string
                          value: { }
                        additionalProperties: false
                      description: Package variable (see integration documentation for more information)
                  additionalProperties: false
              type:
                type: string
              var_group_selections:
                type: object
                additionalProperties:
                  maxLength: 1024
                  type: string
                description: Variable group selections. Maps var_group name to the selected option name within that group.
              vars:
                type: object
                additionalProperties:
                  required:
                    - value
                  type: object
                  properties:
                    frozen:
                      type: boolean
                    type:
                      type: string
                    value: { }
                  additionalProperties: false
                description: Package variable (see integration documentation for more information)
            additionalProperties: false
        is_managed:
          type: boolean
        name:
          type: string
          description: Unique name for the package policy.
        namespace:
          maxLength: 100
          type: string
          description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
        output_id:
          type:
            - 'null'
            - string
        overrides:
          type:
            - 'null'
            - object
          properties:
            inputs:
              type: object
              additionalProperties: { }
          additionalProperties: false
          description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        package_agent_version_condition:
          type: string
        policy_id:
          type:
            - 'null'
            - string
          description: ID of the agent policy which the package policy will be added to.
          deprecated: true
        policy_ids:
          maxItems: 1000
          type: array
          items:
            type: string
            description: IDs of the agent policies that the package policy will be added to.
        spaceIds:
          maxItems: 100
          type: array
          items:
            type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.
          deprecated: true
        supports_cloud_connector:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy supports cloud connectors.
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          type: object
          additionalProperties:
            required:
              - value
            type: object
            properties:
              frozen:
                type: boolean
              type:
                type: string
              value: { }
            additionalProperties: false
          description: Package variable (see integration documentation for more information)
      additionalProperties: false
    Kibana_HTTP_APIs_create_package_policy_response:
      title: create_package_policy_response
      required:
        - item
      type: object
      properties:
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_response'
      additionalProperties: false
    Kibana_HTTP_APIs_data_visualizer_field_stats:
      oneOf:
        - required:
            - view_type
            - data_view_id
          type: object
          properties:
            data_view_id:
              maxLength: 1000
              minLength: 1
              type: string
              description: Data view ID (stored as a panel reference).
            description:
              type: string
              description: A short description of the panel.
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            show_distributions:
              type: boolean
              description: Whether to show the distribution mini-charts in the table.
              default: false
            time_range:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
            title:
              type: string
              description: The panel title.
            view_type:
              enum:
                - dataview
              type: string
          additionalProperties: false
        - required:
            - view_type
            - query
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            query:
              required:
                - esql
              type: object
              properties:
                esql:
                  maxLength: 1000
                  type: string
                  description: The ES|QL query string.
              additionalProperties: false
              description: ES|QL query.
            show_distributions:
              type: boolean
              description: Whether to show the distribution mini-charts in the table.
              default: false
            time_range:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
            title:
              type: string
              description: The panel title.
            view_type:
              enum:
                - esql
              type: string
          additionalProperties: false
      description: Field statistics table embeddable schema
      discriminator:
        propertyName: view_type
    Kibana_HTTP_APIs_datasetquality-degradeddocs-create-rule-body-alerting:
      title: Degraded docs
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Degraded Docs Rule Params
          required:
            - timeUnit
            - timeSize
            - threshold
            - comparator
            - searchConfiguration
          type: object
          properties:
            comparator:
              type: string
            groupBy:
              type: array
              items:
                type: string
            searchConfiguration:
              required:
                - index
              type: object
              properties:
                index:
                  type: string
              additionalProperties: false
            threshold:
              type: array
              items:
                type: number
            timeSize:
              type: number
            timeUnit:
              type: string
          additionalProperties: false
          description: The parameters for the degraded docs rule. These parameters are appropriate when `rule_type_id` is `datasetQuality.degradedDocs`.
        rule_type_id:
          enum:
            - datasetQuality.degradedDocs
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_datatableLibItemNoESQL:
      title: Datatable Chart (library)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metrics:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  alignment:
                    enum:
                      - left
                      - center
                      - right
                    type: string
                    description: Alignment of the columns.
                    default: right
                  apply_color_to:
                    anyOf:
                      - enum:
                          - value
                          - background
                        type: string
                        description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                      - enum:
                          - badge
                        type: string
                    description: 'Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay.'
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    description: Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
                    default:
                      type: auto
                  summary:
                    required:
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                        description: Summary row label.
                      type:
                        anyOf:
                          - enum:
                              - sum
                            type: string
                          - enum:
                              - avg
                            type: string
                          - enum:
                              - count
                            type: string
                          - enum:
                              - min
                            type: string
                          - enum:
                              - max
                            type: string
                        description: Type of summary function to apply to the column.
                    additionalProperties: false
                    description: Summary row configuration
                  visible:
                    type: boolean
                    description: 'When `false`, hides the column from the datatable.'
                    default: true
                  width:
                    minimum: 0
                    type: number
                    description: Column width in pixels.
                additionalProperties: false
          description: Array of metrics to display as columns in the datatable
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        rows:
          maxItems: 50
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  alignment:
                    enum:
                      - left
                      - center
                      - right
                    type: string
                    description: Alignment of the rows.
                    default: left
                  apply_color_to:
                    anyOf:
                      - enum:
                          - value
                          - background
                        type: string
                        description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                      - enum:
                          - badge
                        type: string
                    description: 'Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay.'
                  click_filter:
                    type: boolean
                    description: 'When `true`, enables one-click filtering on cell values.'
                    default: false
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
                  visible:
                    type: boolean
                    description: 'When `false`, hides the column from the datatable.'
                    default: true
                  width:
                    minimum: 0
                    type: number
                    description: Column width in pixels.
                additionalProperties: false
          description: Array of operations to split the datatable rows by
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        split_metrics_by:
          maxItems: 20
          minItems: 1
          type: array
          items:
            title: Breakdown Operation
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            description: 'Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.'
          description: Array of operations to split the metric columns by
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - data_table
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_delete_agent_policy_request:
      title: delete_agent_policy_request
      required:
        - agentPolicyId
      type: object
      properties:
        agentPolicyId:
          type: string
          description: The ID of the agent policy
        force:
          type: boolean
          description: bypass validation checks that can prevent agent policy deletion
      additionalProperties: false
    Kibana_HTTP_APIs_delete_agent_policy_response:
      title: delete_agent_policy_response
      required:
        - id
        - name
      type: object
      properties:
        id:
          type: string
        name:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_delete_enrollment_api_key_response:
      title: delete_enrollment_api_key_response
      required:
        - action
      type: object
      properties:
        action:
          enum:
            - deleted
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_delete_one_package_policy_response:
      title: delete_one_package_policy_response
      required:
        - id
      type: object
      properties:
        id:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_delete_package_datastream_assets_response:
      title: delete_package_datastream_assets_response
      required:
        - success
      type: object
      properties:
        success:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_delete_package_policies_request:
      title: delete_package_policies_request
      required:
        - packagePolicyIds
      type: object
      properties:
        force:
          type: boolean
        packagePolicyIds:
          maxItems: 1000
          type: array
          items:
            type: string
      additionalProperties: false
    Kibana_HTTP_APIs_delete_package_policies_response_item:
      title: delete_package_policies_response_item
      required:
        - id
        - success
        - policy_ids
        - package
      type: object
      properties:
        body:
          required:
            - message
          type: object
          properties:
            message:
              type: string
          additionalProperties: false
        id:
          type: string
        name:
          type: string
        output_id:
          type:
            - 'null'
            - string
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        policy_id:
          type:
            - 'null'
            - string
          description: Use `policy_ids` instead
          deprecated: true
        policy_ids:
          maxItems: 10000
          type: array
          items:
            type: string
        statusCode:
          type: number
        success:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_delete_package_response:
      title: delete_package_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kibana_asset_reference'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_es_asset_reference'
      additionalProperties: false
    Kibana_HTTP_APIs_dry_run_package_policies_request:
      title: dry_run_package_policies_request
      required:
        - packagePolicyIds
      type: object
      properties:
        packagePolicyIds:
          maxItems: 1000
          type: array
          items:
            type: string
        packageVersion:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_dry_run_package_policy:
      title: dry_run_package_policy
      required:
        - name
        - enabled
        - inputs
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        cloud_connector_id:
          type:
            - 'null'
            - string
          description: ID of the cloud connector associated with this package policy.
        cloud_connector_name:
          maxLength: 255
          minLength: 1
          type:
            - 'null'
            - string
          description: Transient field for cloud connector name during creation.
        condition:
          maxLength: 10000
          type:
            - 'null'
            - string
          description: Agent condition expression to evaluate whether to apply this integration to its inputs.
        created_at:
          type: string
        created_by:
          type: string
        description:
          type: string
          description: Package policy description
        elasticsearch:
          type: object
          properties:
            privileges:
              type: object
              properties:
                cluster:
                  maxItems: 100
                  type: array
                  items:
                    type: string
        enabled:
          type: boolean
        errors:
          maxItems: 10
          type: array
          items:
            required:
              - message
            type: object
            properties:
              key:
                type: string
              message:
                type: string
            additionalProperties: false
        force:
          type: boolean
        global_data_tags:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
                description: The name of the custom field. Cannot contain spaces.
              value:
                type:
                  - number
                  - string
                description: The value of the custom field.
            additionalProperties: false
        id:
          maxLength: 255
          type: string
        inputs:
          maxItems: 100
          type: array
          items:
            required:
              - type
              - enabled
              - streams
              - compiled_input
            type: object
            properties:
              compiled_input: { }
              condition:
                maxLength: 10000
                type:
                  - 'null'
                  - string
                description: Agent condition expression to evaluate whether to apply this input.
              config:
                type: object
                additionalProperties:
                  required:
                    - value
                  type: object
                  properties:
                    frozen:
                      type: boolean
                    type:
                      type: string
                    value: { }
                  additionalProperties: false
                description: Package variable (see integration documentation for more information)
              deprecated:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info'
              enabled:
                type: boolean
              id:
                type: string
              keep_enabled:
                type: boolean
              migrate_from:
                type: string
              name:
                type: string
              policy_template:
                type: string
              streams:
                maxItems: 1000
                type: array
                items:
                  required:
                    - enabled
                    - data_stream
                    - compiled_stream
                  type: object
                  properties:
                    compiled_stream: { }
                    condition:
                      maxLength: 10000
                      type:
                        - 'null'
                        - string
                      description: Agent condition expression to evaluate whether to apply this stream.
                    config:
                      type: object
                      additionalProperties:
                        required:
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            type: string
                          value: { }
                        additionalProperties: false
                      description: Package variable (see integration documentation for more information)
                    data_stream:
                      required:
                        - dataset
                      type: object
                      properties:
                        dataset:
                          type: string
                        elasticsearch:
                          type: object
                          properties:
                            dynamic_dataset:
                              type: boolean
                            dynamic_namespace:
                              type: boolean
                            privileges:
                              type: object
                              properties:
                                indices:
                                  maxItems: 100
                                  type: array
                                  items:
                                    type: string
                              additionalProperties: false
                          additionalProperties: false
                        type:
                          type: string
                      additionalProperties: false
                    deprecated:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info'
                    enabled:
                      type: boolean
                    id:
                      type: string
                    keep_enabled:
                      type: boolean
                    migrate_from:
                      type: string
                    release:
                      enum:
                        - ga
                        - beta
                        - experimental
                      type: string
                    var_group_selections:
                      type: object
                      additionalProperties:
                        maxLength: 1024
                        type: string
                      description: Variable group selections. Maps var_group name to the selected option name within that group.
                    vars:
                      type: object
                      additionalProperties:
                        required:
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            type: string
                          value: { }
                        additionalProperties: false
                      description: Package variable (see integration documentation for more information)
                  additionalProperties: false
              type:
                type: string
              var_group_selections:
                type: object
                additionalProperties:
                  maxLength: 1024
                  type: string
                description: Variable group selections. Maps var_group name to the selected option name within that group.
              vars:
                type: object
                additionalProperties:
                  required:
                    - value
                  type: object
                  properties:
                    frozen:
                      type: boolean
                    type:
                      type: string
                    value: { }
                  additionalProperties: false
                description: Package variable (see integration documentation for more information)
            additionalProperties: false
        is_managed:
          type: boolean
        missingVars:
          maxItems: 100
          type: array
          items:
            type: string
        name:
          type: string
          description: Unique name for the package policy.
        namespace:
          maxLength: 100
          type: string
          description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
        output_id:
          type:
            - 'null'
            - string
        overrides:
          type:
            - 'null'
            - object
          properties:
            inputs:
              type: object
              additionalProperties: { }
          additionalProperties: false
          description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        package_agent_version_condition:
          type: string
        policy_id:
          type:
            - 'null'
            - string
          description: ID of the agent policy which the package policy will be added to.
          deprecated: true
        policy_ids:
          maxItems: 1000
          type: array
          items:
            type: string
            description: IDs of the agent policies that the package policy will be added to.
        revision:
          type: number
        secret_references:
          maxItems: 1000
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
            additionalProperties: false
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy belongs to an agentless agent policy.
        supports_cloud_connector:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy supports cloud connectors.
        updated_at:
          type: string
        updated_by:
          type: string
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          type: object
          additionalProperties:
            required:
              - value
            type: object
            properties:
              frozen:
                type: boolean
              type:
                type: string
              value: { }
            additionalProperties: false
          description: Package variable (see integration documentation for more information)
        version:
          type: string
          description: Package policy ES version.
    Kibana_HTTP_APIs_dry_run_package_policy_response:
      title: dry_run_package_policy_response
      required:
        - name
        - enabled
        - inputs
        - revision
        - updated_at
        - updated_by
        - created_at
        - created_by
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        agents:
          type: number
        cloud_connector_id:
          type:
            - 'null'
            - string
          description: ID of the cloud connector associated with this package policy.
        cloud_connector_name:
          maxLength: 255
          minLength: 1
          type:
            - 'null'
            - string
          description: Transient field for cloud connector name during creation.
        condition:
          maxLength: 10000
          type:
            - 'null'
            - string
          description: Agent condition expression to evaluate whether to apply this integration to its inputs.
        created_at:
          type: string
        created_by:
          type: string
        description:
          type: string
          description: Package policy description
        elasticsearch:
          type: object
          properties:
            privileges:
              type: object
              properties:
                cluster:
                  maxItems: 100
                  type: array
                  items:
                    type: string
        enabled:
          type: boolean
        global_data_tags:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
                description: The name of the custom field. Cannot contain spaces.
              value:
                type:
                  - number
                  - string
                description: The value of the custom field.
            additionalProperties: false
        id:
          maxLength: 255
          type: string
        inputs:
          anyOf:
            - maxItems: 100
              type: array
              items:
                required:
                  - type
                  - enabled
                  - streams
                  - compiled_input
                type: object
                properties:
                  compiled_input: { }
                  condition:
                    maxLength: 10000
                    type:
                      - 'null'
                      - string
                    description: Agent condition expression to evaluate whether to apply this input.
                  config:
                    type: object
                    additionalProperties:
                      required:
                        - value
                      type: object
                      properties:
                        frozen:
                          type: boolean
                        type:
                          type: string
                        value: { }
                      additionalProperties: false
                    description: Package variable (see integration documentation for more information)
                  deprecated:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info'
                  enabled:
                    type: boolean
                  id:
                    type: string
                  keep_enabled:
                    type: boolean
                  migrate_from:
                    type: string
                  name:
                    type: string
                  policy_template:
                    type: string
                  streams:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - enabled
                        - data_stream
                        - compiled_stream
                      type: object
                      properties:
                        compiled_stream: { }
                        condition:
                          maxLength: 10000
                          type:
                            - 'null'
                            - string
                          description: Agent condition expression to evaluate whether to apply this stream.
                        config:
                          type: object
                          additionalProperties:
                            required:
                              - value
                            type: object
                            properties:
                              frozen:
                                type: boolean
                              type:
                                type: string
                              value: { }
                            additionalProperties: false
                          description: Package variable (see integration documentation for more information)
                        data_stream:
                          required:
                            - dataset
                          type: object
                          properties:
                            dataset:
                              type: string
                            elasticsearch:
                              type: object
                              properties:
                                dynamic_dataset:
                                  type: boolean
                                dynamic_namespace:
                                  type: boolean
                                privileges:
                                  type: object
                                  properties:
                                    indices:
                                      maxItems: 100
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                            type:
                              type: string
                          additionalProperties: false
                        deprecated:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info'
                        enabled:
                          type: boolean
                        id:
                          type: string
                        keep_enabled:
                          type: boolean
                        migrate_from:
                          type: string
                        release:
                          enum:
                            - ga
                            - beta
                            - experimental
                          type: string
                        var_group_selections:
                          type: object
                          additionalProperties:
                            maxLength: 1024
                            type: string
                          description: Variable group selections. Maps var_group name to the selected option name within that group.
                        vars:
                          type: object
                          additionalProperties:
                            required:
                              - value
                            type: object
                            properties:
                              frozen:
                                type: boolean
                              type:
                                type: string
                              value: { }
                            additionalProperties: false
                          description: Package variable (see integration documentation for more information)
                      additionalProperties: false
                  type:
                    type: string
                  var_group_selections:
                    type: object
                    additionalProperties:
                      maxLength: 1024
                      type: string
                    description: Variable group selections. Maps var_group name to the selected option name within that group.
                  vars:
                    type: object
                    additionalProperties:
                      required:
                        - value
                      type: object
                      properties:
                        frozen:
                          type: boolean
                        type:
                          type: string
                        value: { }
                      additionalProperties: false
                    description: Package variable (see integration documentation for more information)
                additionalProperties: false
            - type: object
              additionalProperties:
                type: object
                properties:
                  condition:
                    maxLength: 10000
                    type:
                      - 'null'
                      - string
                    description: Agent condition expression to evaluate whether to apply this input.
                  deprecated:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info'
                  enabled:
                    type: boolean
                    description: Enable or disable that input. Defaults to `true` (enabled).
                  streams:
                    type: object
                    additionalProperties:
                      type: object
                      properties:
                        condition:
                          maxLength: 10000
                          type:
                            - 'null'
                            - string
                          description: Agent condition expression to evaluate whether to apply this stream.
                        deprecated:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info'
                        enabled:
                          type: boolean
                          description: Enable or disable that stream. Defaults to `true` (enabled).
                        var_group_selections:
                          type: object
                          additionalProperties:
                            maxLength: 1024
                            type: string
                          description: Variable group selections. Maps var_group name to the selected option name within that group.
                        vars:
                          type: object
                          additionalProperties:
                            anyOf:
                              - maxLength: 10000
                                type: string
                              - type: number
                              - type: boolean
                              - maxItems: 100
                                type: array
                                items:
                                  maxLength: 10000
                                  type: string
                              - maxItems: 100
                                type: array
                                items:
                                  type: number
                              - required:
                                  - id
                                  - isSecretRef
                                type: object
                                properties:
                                  id:
                                    maxLength: 255
                                    type: string
                                  isSecretRef:
                                    type: boolean
                                additionalProperties: false
                            default: 'null'
                          description: Input/stream level variable. Refer to the integration documentation for more information.
                      additionalProperties: false
                    description: Input streams. Refer to the integration documentation to know which streams are available.
                  vars:
                    type: object
                    additionalProperties:
                      anyOf:
                        - maxLength: 10000
                          type: string
                        - type: number
                        - type: boolean
                        - maxItems: 100
                          type: array
                          items:
                            maxLength: 10000
                            type: string
                        - maxItems: 100
                          type: array
                          items:
                            type: number
                        - required:
                            - id
                            - isSecretRef
                          type: object
                          properties:
                            id:
                              maxLength: 255
                              type: string
                            isSecretRef:
                              type: boolean
                          additionalProperties: false
                      default: 'null'
                    description: Input/stream level variable. Refer to the integration documentation for more information.
                additionalProperties: false
              description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
          description: Package policy inputs.
        is_managed:
          type: boolean
        name:
          type: string
          description: Unique name for the package policy.
        namespace:
          maxLength: 100
          type: string
          description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
        output_id:
          type:
            - 'null'
            - string
        overrides:
          type:
            - 'null'
            - object
          properties:
            inputs:
              type: object
              additionalProperties: { }
          additionalProperties: false
          description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        package_agent_version_condition:
          type: string
        policy_id:
          type:
            - 'null'
            - string
          description: ID of the agent policy which the package policy will be added to.
          deprecated: true
        policy_ids:
          maxItems: 1000
          type: array
          items:
            type: string
            description: IDs of the agent policies that the package policy will be added to.
        revision:
          type: number
          description: Package policy revision.
        secret_references:
          maxItems: 1000
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
            additionalProperties: false
        spaceIds:
          maxItems: 100
          type: array
          items:
            type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy belongs to an agentless agent policy.
        supports_cloud_connector:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy supports cloud connectors.
        updated_at:
          type: string
        updated_by:
          type: string
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          anyOf:
            - type: object
              additionalProperties:
                required:
                  - value
                type: object
                properties:
                  frozen:
                    type: boolean
                  type:
                    type: string
                  value: { }
                additionalProperties: false
              description: Package variable (see integration documentation for more information)
            - type: object
              additionalProperties:
                anyOf:
                  - maxLength: 10000
                    type: string
                  - type: number
                  - type: boolean
                  - maxItems: 100
                    type: array
                    items:
                      maxLength: 10000
                      type: string
                  - maxItems: 100
                    type: array
                    items:
                      type: number
                  - required:
                      - id
                      - isSecretRef
                    type: object
                    properties:
                      id:
                        maxLength: 255
                        type: string
                      isSecretRef:
                        type: boolean
                    additionalProperties: false
                default: 'null'
              description: Input/stream level variable. Refer to the integration documentation for more information.
          description: Package level variable.
        version:
          type: string
          description: Package policy ES version.
      additionalProperties: false
    Kibana_HTTP_APIs_enrollment_api_key:
      title: enrollment_api_key
      required:
        - id
        - api_key_id
        - api_key
        - active
        - created_at
      type: object
      properties:
        active:
          type: boolean
          description: 'When false, the enrollment API key is revoked and cannot be used for enrolling Elastic Agents.'
        api_key:
          type: string
          description: The enrollment API key (token) used for enrolling Elastic Agents.
        api_key_id:
          type: string
          description: The ID of the API key in the Security API.
        created_at:
          type: string
        expire_at:
          type: string
          description: The expiration date of the enrollment token as an ISO 8601 date string. Absent when the token never expires.
        hidden:
          type: boolean
        id:
          type: string
        name:
          type: string
          description: The name of the enrollment API key.
        policy_id:
          type: string
          description: The ID of the agent policy the Elastic Agent will be enrolled in.
      additionalProperties: false
    Kibana_HTTP_APIs_enrollment_api_key_response:
      title: enrollment_api_key_response
      required:
        - item
      type: object
      properties:
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key'
      additionalProperties: false
    Kibana_HTTP_APIs_es_asset_reference:
      title: es_asset_reference
      required:
        - id
        - type
      type: object
      properties:
        customDataStreamOriginDataset:
          type: string
        customDataStreamOriginType:
          type: string
        deferred:
          type: boolean
        id:
          type: string
        type:
          enum:
            - index
            - index_template
            - component_template
            - ingest_pipeline
            - ilm_policy
            - data_stream_ilm_policy
            - transform
            - ml_model
            - knowledge_base
            - esql_view
          type: string
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_es-query-create-rule-body-alerting:
      title: ES query
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: ES Query Rule Params
          required:
            - size
            - timeWindowSize
            - timeWindowUnit
            - threshold
            - thresholdComparator
            - timeField
            - searchConfiguration
            - esQuery
            - index
            - esqlQuery
          type: object
          properties:
            aggField:
              minLength: 1
              type: string
              description: 'The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.'
            aggType:
              type: string
              description: The type of aggregation to perform.
              default: count
            esqlQuery:
              anyOf:
                - type: array
                  items: { }
                - type: boolean
                - type: number
                - type: object
                - type: string
              oneOf:
                - required:
                    - esql
                  type: object
                  properties:
                    esql:
                      minLength: 1
                      type: string
                  additionalProperties: false
                - not: { }
              description: The query definition in Elasticsearch Query Language.
            esQuery:
              anyOf:
                - type: array
                  items: { }
                - type: boolean
                - type: number
                - type: object
                - type: string
              oneOf:
                - minLength: 1
                  type: string
                - not: { }
            excludeHitsFromPreviousRun:
              type: boolean
              description: 'Indicates whether to exclude matches from previous runs. If `true`, you can avoid alert duplication by excluding documents that have already been detected by the previous rule run. This option is not available when a grouping field is specified.'
              default: true
            groupBy:
              type: string
              description: 'Indicates whether the aggregation is applied over all documents (`all`), grouped by row (`row`), or split into groups (`top`) using a grouping field (`termField`) where only the top groups (up to `termSize` number of groups) are checked. If grouping is used, an alert will be created for each group when it exceeds the threshold.'
              default: all
            index:
              anyOf:
                - type: array
                  items: { }
                - type: boolean
                - type: number
                - type: object
                - type: string
              oneOf:
                - minItems: 1
                  type: array
                  items:
                    minLength: 1
                    type: string
                - not: { }
              description: The indices to query.
            searchConfiguration:
              anyOf:
                - type: array
                  items: { }
                - type: boolean
                - type: number
                - type: object
                - type: string
              oneOf:
                - type: object
                - not: { }
              description: 'The query definition, which uses KQL or Lucene to fetch the documents from Elasticsearch.'
            searchType:
              enum:
                - searchSource
                - esQuery
                - esqlQuery
              type: string
              description: 'The type of query For example: `esQuery` for Elasticsearch Query DSL or `esqlQuery` for Elasticsearch Query Language (ES|QL).'
              default: esQuery
            size:
              maximum: 10000
              minimum: 0
              type: number
              description: The number of documents to pass to the configured actions when the threshold condition is met.
            sourceFields:
              maxItems: 5
              type: array
              items:
                required:
                  - label
                  - searchPath
                type: object
                properties:
                  label:
                    type: string
                  searchPath:
                    type: string
                additionalProperties: false
              description: The sourceFields param is ignored.
            termField:
              anyOf:
                - minLength: 1
                  type: string
                - maxItems: 4
                  minItems: 2
                  type: array
                  items:
                    type: string
              description: The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
            termSize:
              minimum: 1
              type: number
              description: This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
            threshold:
              maxItems: 2
              minItems: 1
              type: array
              items:
                type: number
                description: 'The threshold value that is used with the `thresholdComparator`. If the `thresholdComparator` is `between` or `notBetween`, you must specify the boundary values.'
            thresholdComparator:
              enum:
                - '>'
                - <
                - '>='
                - <=
                - between
                - notBetween
              type: string
              description: 'The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between.'
            timeField:
              anyOf:
                - type: array
                  items: { }
                - type: boolean
                - type: number
                - type: object
                - type: string
              oneOf:
                - minLength: 1
                  type: string
                - minLength: 1
                  type: string
              description: The field that is used to calculate the time window.
            timeWindowSize:
              minimum: 1
              type: number
              description: 'The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
            timeWindowUnit:
              type: string
              description: 'The type of units for the time window. For example: seconds, minutes, hours, or days.'
          additionalProperties: false
          description: The parameters for the ES query rule. These parameters are appropriate when `rule_type_id` is `.es-query`.
        rule_type_id:
          enum:
            - .es-query
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_esqlDataSource:
      title: ES|QL Data Source
      required:
        - type
        - query
      type: object
      properties:
        query:
          type: string
          description: 'An ES|QL query that drives the data source. The query must produce a tabular result set; column names are used as field references. Example: "FROM logs-* | STATS count = COUNT(*) BY host.name".'
        type:
          enum:
            - esql
          type: string
      additionalProperties: false
      description: Uses an ES|QL query as the data source. The query is executed at render time; resulting columns are available as fields.
    Kibana_HTTP_APIs_FailureStore:
      anyOf:
        - required:
            - inherit
          type: object
          properties:
            inherit:
              type: object
              additionalProperties: false
          additionalProperties: false
        - required:
            - disabled
          type: object
          properties:
            disabled:
              type: object
              additionalProperties: false
          additionalProperties: false
        - required:
            - lifecycle
          type: object
          properties:
            lifecycle:
              required:
                - enabled
              type: object
              properties:
                enabled:
                  type: object
                  properties:
                    data_retention:
                      minLength: 1
                      type: string
                      description: A non-empty string.
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        - required:
            - lifecycle
          type: object
          properties:
            lifecycle:
              required:
                - disabled
              type: object
              properties:
                disabled:
                  type: object
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
    Kibana_HTTP_APIs_FieldDefinition:
      type: object
      additionalProperties:
        $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinitionConfig'
    Kibana_HTTP_APIs_FieldDefinitionConfig:
      allOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
        - anyOf:
            - required:
                - type
              type: object
              properties:
                description:
                  type: string
                format:
                  minLength: 1
                  type: string
                  description: A non-empty string.
                type:
                  enum:
                    - keyword
                    - match_only_text
                    - long
                    - double
                    - date
                    - boolean
                    - ip
                    - geo_point
                    - integer
                    - short
                    - byte
                    - float
                    - half_float
                    - text
                    - wildcard
                    - version
                    - unsigned_long
                    - date_nanos
                  type: string
              additionalProperties: false
            - required:
                - description
              type: object
              properties:
                description:
                  type: string
                format:
                  not: { }
                type:
                  not: { }
              additionalProperties: false
            - required:
                - type
              type: object
              properties:
                description:
                  type: string
                type:
                  enum:
                    - system
                  type: string
              additionalProperties: false
    Kibana_HTTP_APIs_FilterCondition:
      anyOf:
        - required:
            - field
          type: object
          properties:
            contains:
              type:
                - boolean
                - number
                - string
              description: Contains comparison value.
            endsWith:
              type:
                - boolean
                - number
                - string
              description: Ends-with comparison value.
            eq:
              type:
                - boolean
                - number
                - string
              description: Equality comparison value.
            field:
              minLength: 1
              type: string
              description: The document field to filter on.
            gt:
              type:
                - boolean
                - number
                - string
              description: Greater-than comparison value.
            gte:
              type:
                - boolean
                - number
                - string
              description: Greater-than-or-equal comparison value.
            includes:
              type:
                - boolean
                - number
                - string
              description: Checks if multivalue field includes the value.
            lt:
              type:
                - boolean
                - number
                - string
              description: Less-than comparison value.
            lte:
              type:
                - boolean
                - number
                - string
              description: Less-than-or-equal comparison value.
            neq:
              type:
                - boolean
                - number
                - string
              description: Inequality comparison value.
            range:
              type: object
              properties:
                gt:
                  type:
                    - boolean
                    - number
                    - string
                  description: 'A value that can be a string, number, or boolean.'
                gte:
                  type:
                    - boolean
                    - number
                    - string
                  description: 'A value that can be a string, number, or boolean.'
                lt:
                  type:
                    - boolean
                    - number
                    - string
                  description: 'A value that can be a string, number, or boolean.'
                lte:
                  type:
                    - boolean
                    - number
                    - string
                  description: 'A value that can be a string, number, or boolean.'
              additionalProperties: false
              description: Range comparison values.
            startsWith:
              type:
                - boolean
                - number
                - string
              description: Starts-with comparison value.
          additionalProperties: false
          description: A condition that compares a field to a value or range using an operator as the key.
        - required:
            - field
          type: object
          properties:
            exists:
              type: boolean
              description: Indicates whether the field exists or not.
            field:
              minLength: 1
              type: string
              description: The document field to check.
          additionalProperties: false
          description: A condition that checks for the existence or non-existence of a field.
      description: 'A basic filter condition, either unary or binary.'
    Kibana_HTTP_APIs_find_backfill_response:
      title: find_backfill_response
      required:
        - page
        - per_page
        - total
        - data
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_backfill_response'
        page:
          type: number
        per_page:
          type: number
        total:
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_find_maintenance_windows_response:
      title: find_maintenance_windows_response
      required:
        - page
        - per_page
        - total
        - maintenanceWindows
      type: object
      properties:
        maintenanceWindows:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_response'
          description: The list of maintenance windows.
        page:
          type: number
          description: The current page number.
        per_page:
          type: number
          description: The number of maintenance windows returned per page.
        total:
          type: number
          description: The total number of maintenance windows that match the query.
      additionalProperties: false
    Kibana_HTTP_APIs_full_agent_policy:
      title: full_agent_policy
      required:
        - id
        - outputs
        - inputs
      type: object
      properties:
        agent:
          required:
            - monitoring
            - download
            - features
            - internal
          type: object
          properties:
            download:
              required:
                - sourceURI
              type: object
              properties:
                auth:
                  type: object
                  properties:
                    api_key:
                      type: string
                    headers:
                      maxItems: 100
                      type: array
                      items:
                        required:
                          - key
                          - value
                        type: object
                        properties:
                          key:
                            type: string
                          value:
                            type: string
                        additionalProperties: false
                    password:
                      type: string
                    username:
                      type: string
                  additionalProperties: false
                proxy_headers:
                  type:
                    - 'null'
                    - object
                  additionalProperties:
                    type:
                      - boolean
                      - number
                      - string
                proxy_url:
                  type: string
                secrets:
                  type: object
                  properties:
                    ssl:
                      required:
                        - key
                      type: object
                      properties:
                        key:
                          type: object
                          properties:
                            id:
                              type: string
                sources:
                  maxItems: 3
                  type: array
                  items:
                    type: string
                sourceURI:
                  type: string
                ssl:
                  type: object
                  properties:
                    certificate:
                      type: string
                    certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    key:
                      type: string
                    renegotiation:
                      type: string
                    verification_mode:
                      type: string
                  additionalProperties: false
                target_directory:
                  type: string
                timeout:
                  type: string
              additionalProperties: false
            features:
              type: object
              additionalProperties:
                required:
                  - enabled
                type: object
                properties:
                  enabled:
                    type: boolean
                additionalProperties: false
            internal: { }
            limits:
              type: object
              properties:
                go_max_procs:
                  type: number
              additionalProperties: false
            logging:
              type: object
              properties:
                files:
                  type: object
                  properties:
                    interval:
                      type: string
                    keepfiles:
                      type: number
                    rotateeverybytes:
                      type: number
                  additionalProperties: false
                level:
                  type: string
                metrics:
                  type: object
                  properties:
                    period:
                      type: string
                  additionalProperties: false
                to_files:
                  type: boolean
              additionalProperties: false
            monitoring:
              required:
                - enabled
                - metrics
                - logs
                - traces
                - apm
              type: object
              properties:
                _runtime_experimental:
                  type: string
                apm: { }
                diagnostics:
                  type: object
                  properties:
                    limit:
                      type: object
                      properties:
                        burst:
                          type: number
                        interval:
                          type: string
                      additionalProperties: false
                    uploader:
                      type: object
                      properties:
                        init_dur:
                          type: string
                        max_dur:
                          type: string
                        max_retries:
                          type: number
                      additionalProperties: false
                  additionalProperties: false
                enabled:
                  type: boolean
                http:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                    host:
                      type: string
                    port:
                      type: number
                  additionalProperties: false
                logs:
                  type: boolean
                metrics:
                  type: boolean
                namespace:
                  type: string
                pprof:
                  required:
                    - enabled
                  type: object
                  properties:
                    enabled:
                      type: boolean
                  additionalProperties: false
                traces:
                  type: boolean
                use_output:
                  type: string
              additionalProperties: false
            protection:
              required:
                - enabled
                - uninstall_token_hash
                - signing_key
              type: object
              properties:
                enabled:
                  type: boolean
                signing_key:
                  type: string
                uninstall_token_hash:
                  type: string
              additionalProperties: false
          additionalProperties: false
        connectors:
          type: object
          additionalProperties: { }
        exporters:
          type: object
          additionalProperties: { }
        extensions:
          type: object
          additionalProperties: { }
        fleet:
          anyOf:
            - required:
                - hosts
              type: object
              properties:
                hosts:
                  maxItems: 100
                  type: array
                  items:
                    type: string
                proxy_headers:
                  type:
                    - 'null'
                    - object
                  additionalProperties:
                    type:
                      - boolean
                      - number
                      - string
                proxy_url:
                  type: string
                secrets:
                  type: object
                  properties:
                    ssl:
                      required:
                        - key
                      type: object
                      properties:
                        key:
                          type: object
                          properties:
                            id:
                              type: string
                ssl:
                  type: object
                  properties:
                    certificate:
                      type: string
                    certificate_authorities:
                      maxItems: 10
                      type: array
                      items:
                        type: string
                    key:
                      type: string
                    renegotiation:
                      type: string
                    verification_mode:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            - required:
                - kibana
              type: object
              properties:
                kibana:
                  required:
                    - hosts
                    - protocol
                  type: object
                  properties:
                    hosts:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                    path:
                      type: string
                    protocol:
                      type: string
                  additionalProperties: false
              additionalProperties: false
        id:
          type: string
        inputs:
          maxItems: 10000
          type: array
          items:
            required:
              - id
              - name
              - revision
              - type
              - data_stream
              - use_output
              - package_policy_id
            type: object
            properties:
              data_stream:
                required:
                  - namespace
                type: object
                properties:
                  namespace:
                    type: string
              id:
                type: string
              meta:
                type: object
                properties:
                  package:
                    required:
                      - name
                      - version
                    type: object
                    properties:
                      name:
                        type: string
                      version:
                        type: string
              name:
                type: string
              package_policy_id:
                type: string
              processors:
                maxItems: 10000
                type: array
                items:
                  required:
                    - add_fields
                  type: object
                  properties:
                    add_fields:
                      required:
                        - target
                        - fields
                      type: object
                      properties:
                        fields:
                          type: object
                          additionalProperties:
                            type:
                              - number
                              - string
                        target:
                          type: string
              revision:
                type: number
              streams:
                maxItems: 10000
                type: array
                items:
                  required:
                    - id
                    - data_stream
                  type: object
                  properties:
                    data_stream:
                      required:
                        - dataset
                      type: object
                      properties:
                        dataset:
                          type: string
                        type:
                          type: string
                    id:
                      type: string
              type:
                type: string
              use_output:
                type: string
        namespaces:
          maxItems: 100
          type: array
          items:
            type: string
        output_permissions:
          type: object
          additionalProperties:
            type: object
            additionalProperties: { }
        outputs:
          type: object
          additionalProperties:
            required:
              - type
            type: object
            properties:
              ca_sha256:
                type:
                  - 'null'
                  - string
              hosts:
                maxItems: 100
                type: array
                items:
                  type: string
              proxy_headers:
                type:
                  - 'null'
                  - object
                additionalProperties:
                  type:
                    - boolean
                    - number
                    - string
              proxy_url:
                type: string
              type:
                type: string
        processors:
          type: object
          additionalProperties: { }
        receivers:
          type: object
          additionalProperties: { }
        revision:
          type: number
        secret_references:
          maxItems: 10000
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
            additionalProperties: false
        service:
          type: object
          properties:
            extensions:
              maxItems: 1000
              type: array
              items:
                type: string
            pipelines:
              type: object
              additionalProperties:
                type: object
                properties:
                  exporters:
                    maxItems: 1000
                    type: array
                    items:
                      type: string
                  processors:
                    maxItems: 1000
                    type: array
                    items:
                      type: string
                  receivers:
                    maxItems: 1000
                    type: array
                    items:
                      type: string
                additionalProperties: false
          additionalProperties: false
        signed:
          required:
            - data
            - signature
          type: object
          properties:
            data:
              type: string
            signature:
              type: string
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_gaugeLibItemNoESQL:
      title: Gauge Chart (library)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          allOf:
            - anyOf:
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
            - type: object
              properties:
                color:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNoColor'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                  description: Color configuration for the gauge fill.
                  default:
                    type: auto
                goal:
                  title: 'Field Metric, Static Value, or Formula Operation'
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  description: 'Metric dimension using a field-based aggregation, a static value, or a mathematical formula.'
                max:
                  title: 'Field Metric, Static Value, or Formula Operation'
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  description: 'Metric dimension using a field-based aggregation, a static value, or a mathematical formula.'
                min:
                  title: 'Field Metric, Static Value, or Formula Operation'
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  description: 'Metric dimension using a field-based aggregation, a static value, or a mathematical formula.'
                subtitle:
                  type: string
                  description: Subtitle below the gauge value.
                ticks:
                  type: object
                  properties:
                    mode:
                      anyOf:
                        - enum:
                            - auto
                          type: string
                        - enum:
                            - bands
                          type: string
                      description: Tick placement mode.
                      default: bands
                    visible:
                      type: boolean
                      description: 'When `true`, displays tick marks on the gauge.'
                      default: true
                  additionalProperties: false
                  description: Ticks configuration
                title:
                  type: object
                  properties:
                    text:
                      type: string
                      description: Title text.
                    visible:
                      type: boolean
                      description: 'When `true`, displays the title.'
                      default: true
                  additionalProperties: false
                  description: Title configuration
              additionalProperties: false
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - gauge
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_geo-containment-create-rule-body-alerting:
      title: Geo containment
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Geo Containment Rule Params
          required:
            - index
            - indexId
            - geoField
            - entity
            - dateField
            - boundaryType
            - boundaryIndexTitle
            - boundaryIndexId
            - boundaryGeoField
            - indexQuery
            - boundaryIndexQuery
          type: object
          properties:
            boundaryGeoField:
              minLength: 1
              type: string
            boundaryIndexId:
              minLength: 1
              type: string
            boundaryIndexQuery: { }
            boundaryIndexTitle:
              minLength: 1
              type: string
            boundaryNameField:
              minLength: 1
              type: string
            boundaryType:
              minLength: 1
              type: string
            dateField:
              minLength: 1
              type: string
            entity:
              minLength: 1
              type: string
            geoField:
              minLength: 1
              type: string
            index:
              minLength: 1
              type: string
            indexId:
              minLength: 1
              type: string
            indexQuery: { }
          additionalProperties: false
          description: The parameters for the geo containment rule. These parameters are appropriate when `rule_type_id` is `.geo-containment`.
        rule_type_id:
          enum:
            - .geo-containment
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_get_agent_policy_outputs_response:
      title: get_agent_policy_outputs_response
      required:
        - item
      type: object
      properties:
        item:
          required:
            - monitoring
            - data
          type: object
          properties:
            agentPolicyId:
              type: string
            data:
              required:
                - output
              type: object
              properties:
                integrations:
                  maxItems: 1000
                  type: array
                  items:
                    type: object
                    properties:
                      id:
                        type: string
                      integrationPolicyName:
                        type: string
                      name:
                        type: string
                      pkgName:
                        type: string
                    additionalProperties: false
                output:
                  required:
                    - id
                    - name
                  type: object
                  properties:
                    id:
                      type: string
                    name:
                      type: string
                  additionalProperties: false
              additionalProperties: false
            monitoring:
              required:
                - output
              type: object
              properties:
                output:
                  required:
                    - id
                    - name
                  type: object
                  properties:
                    id:
                      type: string
                    name:
                      type: string
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_agent_policy_response:
      title: get_agent_policy_response
      required:
        - item
      type: object
      properties:
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_agent_policy_response'
      additionalProperties: false
    Kibana_HTTP_APIs_get_bulk_assets_request:
      title: get_bulk_assets_request
      required:
        - assetIds
      type: object
      properties:
        assetIds:
          maxItems: 10000
          type: array
          items:
            required:
              - id
              - type
            type: object
            properties:
              id:
                type: string
              type:
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_bulk_assets_response:
      title: get_bulk_assets_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            required:
              - id
              - type
              - attributes
            type: object
            properties:
              appLink:
                type: string
              attributes:
                type: object
                properties:
                  description:
                    type: string
                  engine:
                    enum:
                      - v1
                      - v2
                    type: string
                  service:
                    type: string
                  title:
                    type: string
                additionalProperties: false
              id:
                type: string
              type:
                type: string
              updatedAt:
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_categories_response:
      title: get_categories_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_category_summary_item'
      additionalProperties: false
    Kibana_HTTP_APIs_get_data_streams_response:
      title: get_data_streams_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            required:
              - name
            type: object
            properties:
              name:
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_dependencies_response:
      title: get_dependencies_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 1000
          type: array
          items:
            required:
              - name
              - version
              - title
            type: object
            properties:
              name:
                type: string
              title:
                type: string
              version:
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_enrollment_api_keys_response:
      title: get_enrollment_api_keys_response
      required:
        - items
        - total
        - page
        - perPage
        - list
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key'
        list:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_enrollment_api_key'
          deprecated: true
        page:
          type: number
        perPage:
          type: number
        total:
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_get_full_agent_policy_response:
      title: get_full_agent_policy_response
      required:
        - item
      type: object
      properties:
        item:
          anyOf:
            - type: string
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_full_agent_policy'
      additionalProperties: false
    Kibana_HTTP_APIs_get_info_response:
      title: get_info_response
      required:
        - item
      type: object
      properties:
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_get_package_info'
        metadata:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_metadata'
      additionalProperties: false
    Kibana_HTTP_APIs_get_inputs_response:
      title: get_inputs_response
      required:
        - inputs
      type: object
      properties:
        connectors:
          type: object
          additionalProperties: { }
        exporters:
          type: object
          additionalProperties: { }
        extensions:
          type: object
          additionalProperties: { }
        inputs:
          maxItems: 10000
          type: array
          items:
            required:
              - id
              - type
            type: object
            properties:
              id:
                type: string
              streams:
                maxItems: 10000
                type: array
                items:
                  required:
                    - id
                    - data_stream
                  type: object
                  properties:
                    data_stream:
                      required:
                        - dataset
                      type: object
                      properties:
                        dataset:
                          type: string
                        type:
                          type: string
                    id:
                      type: string
              type:
                type: string
            additionalProperties: false
        processors:
          type: object
          additionalProperties: { }
        receivers:
          type: object
          additionalProperties: { }
        service:
          type: object
          properties:
            extensions:
              maxItems: 1000
              type: array
              items:
                type: string
            pipelines:
              type: object
              additionalProperties:
                type: object
                properties:
                  exporters:
                    maxItems: 1000
                    type: array
                    items:
                      type: string
                  processors:
                    maxItems: 1000
                    type: array
                    items:
                      type: string
                  receivers:
                    maxItems: 1000
                    type: array
                    items:
                      type: string
                additionalProperties: false
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_installed_packages_response:
      title: get_installed_packages_response
      required:
        - items
        - total
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_installed_package'
        searchAfter:
          maxItems: 2
          type: array
          items:
            anyOf:
              - type: string
              - type: number
              - type: boolean
              - { }
        total:
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_get_k8s_manifest_response:
      title: get_k8s_manifest_response
      required:
        - item
      type: object
      properties:
        item:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_get_limited_packages_response:
      title: get_limited_packages_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            type: string
      additionalProperties: false
    Kibana_HTTP_APIs_get_list_agent_policy_outputs_request:
      title: get_list_agent_policy_outputs_request
      required:
        - ids
      type: object
      properties:
        ids:
          maxItems: 1000
          type: array
          items:
            type: string
          description: list of package policy ids
      additionalProperties: false
    Kibana_HTTP_APIs_get_list_agent_policy_outputs_response:
      title: get_list_agent_policy_outputs_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            required:
              - monitoring
              - data
            type: object
            properties:
              agentPolicyId:
                type: string
              data:
                required:
                  - output
                type: object
                properties:
                  integrations:
                    maxItems: 1000
                    type: array
                    items:
                      type: object
                      properties:
                        id:
                          type: string
                        integrationPolicyName:
                          type: string
                        name:
                          type: string
                        pkgName:
                          type: string
                      additionalProperties: false
                  output:
                    required:
                      - id
                      - name
                    type: object
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                    additionalProperties: false
                additionalProperties: false
              monitoring:
                required:
                  - output
                type: object
                properties:
                  output:
                    required:
                      - id
                      - name
                    type: object
                    properties:
                      id:
                        type: string
                      name:
                        type: string
                    additionalProperties: false
                additionalProperties: false
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_one_bulk_operation_packages_response:
      title: get_one_bulk_operation_packages_response
      required:
        - status
      type: object
      properties:
        error:
          required:
            - message
          type: object
          properties:
            message:
              type: string
          additionalProperties: false
        results:
          maxItems: 10000
          type: array
          items:
            required:
              - name
              - success
            type: object
            properties:
              error:
                required:
                  - message
                type: object
                properties:
                  message:
                    type: string
                additionalProperties: false
              name:
                type: string
              success:
                type: boolean
            additionalProperties: false
        status:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_get_package_info:
      title: get_package_info
      required:
        - name
        - version
        - title
        - assets
      type: object
      properties:
        agent:
          type: object
          properties:
            privileges:
              type: object
              properties:
                root:
                  type: boolean
              additionalProperties: false
          additionalProperties: false
        asset_tags:
          maxItems: 1000
          type: array
          items:
            required:
              - text
            type: object
            properties:
              asset_ids:
                maxItems: 1000
                type: array
                items:
                  type: string
              asset_types:
                maxItems: 100
                type: array
                items:
                  type: string
              text:
                type: string
            additionalProperties: false
        assets:
          type: object
          additionalProperties: { }
        categories:
          maxItems: 100
          type: array
          items:
            type: string
        conditions:
          type: object
          properties:
            deprecated:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_conditions_deprecation_info'
            elastic:
              type: object
              properties:
                capabilities:
                  maxItems: 10
                  type: array
                  items:
                    type: string
                subscription:
                  type: string
            kibana:
              type: object
              properties:
                version:
                  type: string
        data_streams:
          maxItems: 1000
          type: array
          items:
            type: object
            additionalProperties: { }
        deprecated:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_deprecation_info'
        description:
          type: string
        discovery:
          type: object
          properties:
            datasets:
              maxItems: 100
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
            fields:
              maxItems: 100
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
        download:
          type: string
        elasticsearch:
          type: object
          additionalProperties: { }
        format_version:
          type: string
        icons:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_icon'
        installationInfo:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_installation_info'
        internal:
          type: boolean
        keepPoliciesUpToDate:
          type: boolean
        latestVersion:
          type: string
        license:
          type: string
        licensePath:
          type: string
        name:
          type: string
        notice:
          type: string
        owner:
          type: object
          properties:
            github:
              type: string
            type:
              enum:
                - elastic
                - partner
                - community
              type: string
        path:
          type: string
        policy_templates:
          maxItems: 1000
          type: array
          items:
            type: object
            additionalProperties: { }
        readme:
          type: string
        release:
          enum:
            - ga
            - beta
            - experimental
          type: string
        screenshots:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_icon'
        signature_path:
          type: string
        source:
          required:
            - license
          type: object
          properties:
            license:
              type: string
        status:
          type: string
        title:
          type: string
        type:
          anyOf:
            - enum:
                - integration
              type: string
            - enum:
                - input
              type: string
            - enum:
                - content
              type: string
            - type: string
        var_groups:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - title
              - selector_title
              - options
            type: object
            properties:
              description:
                type: string
              name:
                type: string
              options:
                maxItems: 100
                type: array
                items:
                  required:
                    - name
                    - title
                    - vars
                  type: object
                  properties:
                    description:
                      type: string
                    hide_in_deployment_modes:
                      maxItems: 2
                      type: array
                      items:
                        enum:
                          - default
                          - agentless
                        type: string
                    name:
                      type: string
                    title:
                      type: string
                    vars:
                      maxItems: 100
                      type: array
                      items:
                        type: string
              selector_title:
                type: string
              title:
                type: string
        vars:
          maxItems: 1000
          type: array
          items:
            type: object
            additionalProperties: { }
        version:
          type: string
    Kibana_HTTP_APIs_get_packages_response:
      title: get_packages_response
      required:
        - items
      type: object
      properties:
        items:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_list_item'
      additionalProperties: false
    Kibana_HTTP_APIs_get_stats_response:
      title: get_stats_response
      required:
        - response
      type: object
      properties:
        response:
          required:
            - agent_policy_count
            - package_policy_count
          type: object
          properties:
            agent_policy_count:
              type: number
            package_policy_count:
              type: number
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_get_verification_key_id_response:
      title: get_verification_key_id_response
      required:
        - id
      type: object
      properties:
        id:
          type:
            - 'null'
            - string
      additionalProperties: false
    Kibana_HTTP_APIs_heatmapLibItemNoESQL:
      title: Heatmap Chart (library)
      required:
        - type
        - x
        - data_source
        - metric
      type: object
      properties:
        axis:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapAxes'
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapLegend'
        metric:
          allOf:
            - anyOf:
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
            - type: object
              properties:
                color:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                  description: Color scale configuration for the heatmap cells.
                  default:
                    type: auto
              additionalProperties: false
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - heatmap
          type: string
        x:
          title: Breakdown Operation
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
          description: 'Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.'
        y:
          title: Breakdown Operation
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
          description: 'Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.'
      additionalProperties: false
    Kibana_HTTP_APIs_index-threshold-create-rule-body-alerting:
      title: Index threshold
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Index Threshold Rule Params
          required:
            - index
            - timeField
            - timeWindowSize
            - timeWindowUnit
            - thresholdComparator
            - threshold
          type: object
          properties:
            aggField:
              minLength: 1
              type: string
              description: 'The name of the numeric field that is used in the aggregation. This property is required when `aggType` is `avg`, `max`, `min` or `sum`.'
            aggType:
              type: string
              description: The type of aggregation to perform.
              default: count
            filterKuery:
              type: string
              description: A Kibana Query Language (KQL) expression thats limits the scope of alerts.
            groupBy:
              type: string
              description: 'Indicates whether the aggregation is applied over all documents (`all`) or split into groups (`top`) using a grouping field (`termField`). If grouping is used, an alert will be created for each group when it exceeds the threshold; only the top groups (up to `termSize` number of groups) are checked.'
              default: all
            index:
              anyOf:
                - minLength: 1
                  type: string
                - minItems: 1
                  type: array
                  items:
                    minLength: 1
                    type: string
              description: The indices to query.
            termField:
              minLength: 1
              type: string
              description: The names of up to four fields that are used for grouping the aggregation. This property is required when `groupBy` is `top`.
            termSize:
              minimum: 1
              type: number
              description: This property is required when `groupBy` is `top`. It specifies the number of groups to check against the threshold and therefore limits the number of alerts on high cardinality fields.
            threshold:
              maxItems: 2
              minItems: 1
              type: array
              items:
                type: number
            thresholdComparator:
              enum:
                - '>'
                - <
                - '>='
                - <=
                - between
                - notBetween
              type: string
              description: 'The comparison function for the threshold. For example: greater than, less than, greater than or equal to, between, or not between.'
            timeField:
              minLength: 1
              type: string
              description: The field that is used to calculate the time window.
            timeWindowSize:
              minimum: 1
              type: number
              description: 'The size of the time window (in `timeWindowUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
            timeWindowUnit:
              type: string
              description: 'The type of units for the time window. For example: seconds, minutes, hours, or days.'
          additionalProperties: false
          description: The parameters for the index threshold rule. These parameters are appropriate when `rule_type_id` is `.index-threshold`.
        rule_type_id:
          enum:
            - .index-threshold
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_IngestStreamLifecycle:
      anyOf:
        - required:
            - dsl
          type: object
          properties:
            dsl:
              type: object
              properties:
                data_retention:
                  minLength: 1
                  type: string
                  description: A non-empty string.
                downsample:
                  type: array
                  items:
                    required:
                      - after
                      - fixed_interval
                    type: object
                    properties:
                      after:
                        minLength: 1
                        type: string
                        description: A non-empty string.
                      fixed_interval:
                        minLength: 1
                        type: string
                        description: A non-empty string.
                frozen_after:
                  minLength: 1
                  type: string
                  description: A non-empty string.
              additionalProperties: false
          additionalProperties: false
        - required:
            - ilm
          type: object
          properties:
            ilm:
              required:
                - policy
              type: object
              properties:
                policy:
                  minLength: 1
                  type: string
                  description: A non-empty string.
              additionalProperties: false
          additionalProperties: false
        - required:
            - inherit
          type: object
          properties:
            inherit:
              type: object
              additionalProperties: false
          additionalProperties: false
    Kibana_HTTP_APIs_install_kibana_assets_request:
      title: install_kibana_assets_request
      type: object
      properties:
        force:
          type: boolean
        space_ids:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
          description: 'When provided, assets are installed in the specified spaces instead of the current space.'
      additionalProperties: false
    Kibana_HTTP_APIs_install_kibana_assets_response:
      title: install_kibana_assets_response
      required:
        - success
      type: object
      properties:
        success:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_install_package_from_registry_request:
      title: install_package_from_registry_request
      type: object
      properties:
        allow_outdated_version:
          type: boolean
          description: 'When true, allow installing a version older than the latest available. Bypasses only the out-of-date version check.'
          default: false
        force:
          type: boolean
          default: false
        ignore_constraints:
          type: boolean
          default: false
      additionalProperties: false
    Kibana_HTTP_APIs_install_package_response:
      title: install_package_response
      required:
        - items
        - _meta
      type: object
      properties:
        _meta:
          required:
            - install_source
            - name
          type: object
          properties:
            install_source:
              type: string
            name:
              type: string
          additionalProperties: false
        items:
          maxItems: 10000
          type: array
          items:
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kibana_asset_reference'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_es_asset_reference'
      additionalProperties: false
    Kibana_HTTP_APIs_install_rule_assets_request:
      title: install_rule_assets_request
      type: object
      properties:
        force:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_installed_package:
      title: installed_package
      required:
        - name
        - version
        - status
        - dataStreams
      type: object
      properties:
        dataStreams:
          maxItems: 10000
          type: array
          items:
            required:
              - name
              - title
            type: object
            properties:
              name:
                type: string
              title:
                type: string
            additionalProperties: false
        description:
          type: string
        icons:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_icon'
        name:
          type: string
        rolledBack:
          type: boolean
        status:
          type: string
        title:
          type: string
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeConditionFilterSchema:
      title: condition
      required:
        - type
        - condition
      type: object
      properties:
        condition:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_conditionSchema'
        controlled_by:
          type: string
          description: 'Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.'
        data_view_id:
          type: string
          description: Identifier of the data view used as context for this filter.
        disabled:
          type: boolean
          description: 'When `true`, the filter is inactive and does not affect query results. Defaults to `false`.'
        is_multi_index:
          type: boolean
          description: 'When `true`, the filter can be applied across multiple indices. Defaults to `false`.'
        label:
          type: string
          description: 'Human-readable label for the filter, used for display purposes.'
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        type:
          enum:
            - condition
          type: string
      additionalProperties: false
      description: 'A filter that evaluates a single field condition such as equality, range, or existence.'
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeDSLFilterSchema:
      title: dsl
      required:
        - type
        - dsl
      type: object
      properties:
        controlled_by:
          type: string
          description: 'Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.'
        data_view_id:
          type: string
          description: Identifier of the data view used as context for this filter.
        disabled:
          type: boolean
          description: 'When `true`, the filter is inactive and does not affect query results. Defaults to `false`.'
        dsl:
          type: object
          additionalProperties: { }
          description: Elasticsearch Query DSL object passed directly to the query.
        field:
          type: string
          description: Field name for scripted filters where the field cannot be extracted from the DSL query.
        is_multi_index:
          type: boolean
          description: 'When `true`, the filter can be applied across multiple indices. Defaults to `false`.'
        label:
          type: string
          description: 'Human-readable label for the filter, used for display purposes.'
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        params:
          description: 'Filter parameters metadata. May contain display values, formats, and parameters for scripted filters.'
        type:
          enum:
            - dsl
          type: string
      additionalProperties: false
      description: 'A filter expressed as a raw [Elasticsearch Query DSL](https://www.elastic.co/docs/reference/query-languages/querydsl) object, used for queries that cannot be represented by condition or group filters.'
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema:
      oneOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeConditionFilterSchema'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeGroupFilterSchema'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeDSLFilterSchema'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeSpatialFilterSchema'
      description: 'A filter applied to query results. Can be a field condition (`condition`), a logical group of conditions (`group`), a raw Elasticsearch DSL query (`dsl`), or a geo spatial query (`spatial`).'
      discriminator:
        propertyName: type
        mapping:
          condition: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeConditionFilterSchema'
          dsl: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeDSLFilterSchema'
          group: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeGroupFilterSchema'
          spatial: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeSpatialFilterSchema'
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeGroupFilterSchema:
      title: group
      required:
        - type
        - group
      type: object
      properties:
        controlled_by:
          type: string
          description: 'Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.'
        data_view_id:
          type: string
          description: Identifier of the data view used as context for this filter.
        disabled:
          type: boolean
          description: 'When `true`, the filter is inactive and does not affect query results. Defaults to `false`.'
        group:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_groupConditionSchema'
        is_multi_index:
          type: boolean
          description: 'When `true`, the filter can be applied across multiple indices. Defaults to `false`.'
        label:
          type: string
          description: 'Human-readable label for the filter, used for display purposes.'
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        type:
          enum:
            - group
          type: string
      additionalProperties: false
      description: A filter that combines multiple conditions or nested groups using a logical `and` or `or` operator.
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeSpatialFilterSchema:
      title: spatial
      required:
        - type
        - dsl
      type: object
      properties:
        controlled_by:
          type: string
          description: 'Identifier of the panel that manages this filter. When set, the filter is treated as owned by that panel.'
        data_view_id:
          type: string
          description: Identifier of the data view used as context for this filter.
        disabled:
          type: boolean
          description: 'When `true`, the filter is inactive and does not affect query results. Defaults to `false`.'
        dsl:
          type: object
          additionalProperties: { }
          description: Elasticsearch geo query DSL object.
        is_multi_index:
          type: boolean
          description: 'When `true`, the filter can be applied across multiple indices. Defaults to `false`.'
        label:
          type: string
          description: 'Human-readable label for the filter, used for display purposes.'
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        type:
          enum:
            - spatial
          type: string
      additionalProperties: false
      description: 'A filter that applies an Elasticsearch geo query, used for geographic boundary and shape matching.'
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_exists:
      title: exists
      required:
        - field
        - operator
      type: object
      properties:
        field:
          type: string
          description: Name of the document field the condition evaluates.
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        operator:
          enum:
            - exists
          type: string
      additionalProperties: false
      description: Matches documents where `field` exists and contains a non-null value.
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is:
      title: is
      required:
        - field
        - operator
        - value
      type: object
      properties:
        field:
          type: string
          description: Name of the document field the condition evaluates.
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        operator:
          enum:
            - is
          type: string
        value:
          anyOf:
            - title: value
              type: string
            - title: value
              type: number
            - title: value
              type: boolean
          description: Single value to compare against the field.
      additionalProperties: false
      description: Matches documents where `field` equals a single specified value.
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is_one_of:
      title: is_one_of
      required:
        - field
        - operator
        - value
      type: object
      properties:
        field:
          type: string
          description: Name of the document field the condition evaluates.
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        operator:
          enum:
            - is_one_of
          type: string
        value:
          anyOf:
            - maxItems: 10000
              type: array
              items:
                type: string
            - maxItems: 10000
              type: array
              items:
                type: number
            - maxItems: 10000
              type: array
              items:
                type: boolean
          description: Homogeneous array of values to match against the field.
      additionalProperties: false
      description: Matches documents where `field` equals any value in a provided list.
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_range:
      title: range
      required:
        - field
        - operator
        - value
      type: object
      properties:
        field:
          type: string
          description: Name of the document field the condition evaluates.
        negate:
          type: boolean
          description: 'When `true`, the filter is negated and matches documents that do NOT satisfy the condition. Defaults to `false`.'
        operator:
          enum:
            - range
          type: string
        value:
          type: object
          properties:
            format:
              type: string
              description: 'Elasticsearch [date format](https://www.elastic.co/docs/reference/elasticsearch/mapping-reference/mapping-date-format) string applied when parsing date boundary values. For example, `strict_date_optional_time` or `epoch_millis`.'
            gt:
              type:
                - number
                - string
              description: Greater than.
            gte:
              type:
                - number
                - string
              description: Greater than or equal to.
            lt:
              type:
                - number
                - string
              description: Less than.
            lte:
              type:
                - number
                - string
              description: Less than or equal to.
          additionalProperties: false
          description: Boundary values for a range comparison.
      additionalProperties: false
      description: Matches documents where `field` falls within a specified numeric or date range.
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_conditionSchema:
      oneOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is_one_of'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_range'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_exists'
      description: A filter condition with strict operator/value type matching.
      discriminator:
        propertyName: operator
        mapping:
          exists: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_exists'
          is: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is'
          is_one_of: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_is_one_of'
          range: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_condition_range'
    Kibana_HTTP_APIs_kbn-as-code-filters-schema_groupConditionSchema:
      required:
        - operator
        - conditions
      type: object
      properties:
        conditions:
          type: array
          items:
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_conditionSchema'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_groupConditionSchema'
          description: Ordered list of conditions or nested groups combined by the group `operator`.
        operator:
          anyOf:
            - enum:
                - and
              type: string
            - enum:
                - or
              type: string
          description: 'Logical operator applied across all entries in `conditions`. Use `and` to require all conditions, or `or` to require at least one.'
      additionalProperties: false
      description: Logical group that combines one or more conditions or nested groups.
    Kibana_HTTP_APIs_kbn-as-code-meta:
      type: object
      properties:
        created_at:
          type: string
          description: Timestamp when the object was created (ISO 8601).
        created_by:
          type: string
          description: User profile ID of the user who created the object.
        managed:
          type: boolean
          description: 'When `true`, the object is managed by Kibana and cannot be edited by users.'
        owner:
          type: string
          description: Identifier of the plugin or team that owns this object.
        updated_at:
          type: string
          description: Timestamp when the object was last updated (ISO 8601).
        updated_by:
          type: string
          description: User profile ID of the user who last updated the object.
        version:
          type: string
          description: Internal version identifier for optimistic concurrency control.
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-as-code-query:
      title: Query
      required:
        - expression
        - language
      type: object
      properties:
        expression:
          type: string
          description: A query expression in KQL or Lucene syntax.
        language:
          enum:
            - kql
            - lucene
          type: string
          description: Query language. Use `kql` for Kibana Query Language (KQL) or `lucene` for Lucene query syntax.
      additionalProperties: false
      description: A search query consisting of an expression and its language. Supports KQL and Lucene syntax.
    Kibana_HTTP_APIs_kbn-composite-runtime-field-schema:
      title: Composite runtime field
      required:
        - type
        - fields
      type: object
      properties:
        fields:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-base-schema'
        script:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-script'
        type:
          enum:
            - composite
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema:
      required:
        - name
        - type
        - id
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        type:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-esql-control:
      title: esql_control
      required:
        - type
        - config
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query'
          discriminator:
            propertyName: control_type
            mapping:
              STATIC_VALUES: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values'
              VALUES_FROM_QUERY: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query'
        grow:
          type: boolean
          description: 'When `true`, the control expands to fill any available horizontal space. Defaults to `false`.'
          default: false
        id:
          type: string
          description: The unique ID of the control
        type:
          enum:
            - esql_control
          type: string
        width:
          anyOf:
            - enum:
                - small
              type: string
            - enum:
                - medium
              type: string
            - enum:
                - large
              type: string
          description: Minimum width of the control panel.
          default: medium
      additionalProperties: false
      description: An ES|QL variable control whose selected value is injected into ES|QL visualizations using the `?variable_name` syntax. Options can come from a fixed list or an ES|QL query. Define the options source in `config`.
    Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-options-list-control:
      title: options_list_control
      required:
        - type
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-field'
          discriminator:
            propertyName: values_source
            mapping:
              esql: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql'
        grow:
          type: boolean
          description: 'When `true`, the control expands to fill any available horizontal space. Defaults to `false`.'
          default: false
        id:
          type: string
          description: The unique ID of the control
        type:
          enum:
            - options_list_control
          type: string
        width:
          anyOf:
            - enum:
                - small
              type: string
            - enum:
                - medium
              type: string
            - enum:
                - large
              type: string
          description: Minimum width of the control panel.
          default: medium
      additionalProperties: false
      description: 'A dropdown control that filters data by selecting field values from a data view. Define the data view, field, and selection settings in `config`.'
    Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-range-slider-control:
      title: range_slider_control
      required:
        - type
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-field'
          discriminator:
            propertyName: values_source
            mapping:
              esql: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql'
        grow:
          type: boolean
          description: 'When `true`, the control expands to fill any available horizontal space. Defaults to `false`.'
          default: false
        id:
          type: string
          description: The unique ID of the control
        type:
          enum:
            - range_slider_control
          type: string
        width:
          anyOf:
            - enum:
                - small
              type: string
            - enum:
                - medium
              type: string
            - enum:
                - large
              type: string
          description: Minimum width of the control panel.
          default: medium
      additionalProperties: false
      description: 'A slider control that filters data by selecting a numeric range for the configured field. Define the data view, field, and selection settings in `config`.'
    Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-time-slider-control:
      title: time_slider_control
      required:
        - type
        - config
      type: object
      properties:
        config:
          type: object
          properties:
            end_percentage_of_time_range:
              maximum: 1
              minimum: 0
              type: number
              description: 'The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.'
              default: 1
            is_anchored:
              type: boolean
              description: 'When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`.'
              default: false
            start_percentage_of_time_range:
              maximum: 1
              minimum: 0
              type: number
              description: 'The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.'
              default: 0
          additionalProperties: false
        grow:
          type: boolean
          description: 'When `true`, the control expands to fill any available horizontal space. Defaults to `false`.'
          default: false
        id:
          type: string
          description: The unique ID of the control
        type:
          enum:
            - time_slider_control
          type: string
        width:
          anyOf:
            - enum:
                - small
              type: string
            - enum:
                - medium
              type: string
            - enum:
                - large
              type: string
          description: Minimum width of the control panel.
          default: medium
      additionalProperties: false
      description: A control panel that filters a time field to a selected sub-range of the global time range. Define the start and end positions in `config` as fractions of the global range (0 to 1).
    Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql:
      title: EsqlOptionsListControl
      required:
        - values_source
        - esql_query
      type: object
      properties:
        display_settings:
          type: object
          properties:
            hide_action_bar:
              type: boolean
              description: 'When `true`, the search bar, sorting options, and select all toggle are hidden from the control.'
            hide_exclude:
              type: boolean
              description: 'When `true`, the exclude mode toggle is hidden from the control.'
            hide_exists:
              type: boolean
              description: 'When `true`, the exists filter option is hidden from the control.'
            hide_sort:
              type: boolean
              description: 'When `true`, the sort selector is hidden from the control.'
            placeholder:
              type: string
              description: Placeholder text displayed in the control input when no option is selected.
          additionalProperties: false
        esql_query:
          minLength: 1
          type: string
          description: The ES|QL query that provides field options for this control
        exclude:
          type: boolean
          description: 'When `true`, the control filters to documents that do NOT match the selected options. Defaults to `false`.'
          default: false
        exists_selected:
          type: boolean
          description: 'When `true`, the control filters to documents where the field exists, regardless of the field''s value. Defaults to `false`.'
          default: false
        ignore_validations:
          type: boolean
          description: 'When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.'
          default: false
        run_past_timeout:
          type: boolean
          description: 'When `true`, the options list query continues running even if it exceeds the configured timeout threshold. Defaults to `false`.'
          default: false
        search_technique:
          anyOf:
            - enum:
                - prefix
              type: string
            - enum:
                - wildcard
              type: string
            - enum:
                - exact
              type: string
          description: 'The matching technique used when searching available options. `prefix` matches values starting with the search term, `wildcard` matches values containing the search term, and `exact` requires a complete match. Only applies to string and IP fields. Defaults to `wildcard`.'
          default: wildcard
        selected_options:
          maxItems: 10000
          type: array
          items:
            type:
              - number
              - string
            description: A selected option value. Accepts a string or a number.
          description: The list of currently selected option values.
          default: [ ]
        single_select:
          type: boolean
          description: 'When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `false`.'
          default: false
        sort:
          required:
            - by
            - direction
          type: object
          properties:
            by:
              enum:
                - _count
                - _key
              type: string
              description: The field used to sort the available options list. `_count` sorts by document count and `_key` sorts alphabetically by option value.
            direction:
              enum:
                - asc
                - desc
              type: string
              description: The sort direction. `asc` sorts ascending and `desc` sorts descending.
          additionalProperties: false
          description: 'Defines how the available options are sorted in the control popover. Defaults to `{ by: "_count", direction: "desc" }`.'
          default:
            by: _count
            direction: desc
        title:
          type: string
          description: A human-readable title for the control.
        use_global_filters:
          type: boolean
          description: 'When `true`, the control''s available options are narrowed by the page''s active filters.'
          default: true
        values_source:
          enum:
            - esql
          type: string
      additionalProperties: false
      description: An options list control whose available options come from an ES|QL query's results.
    Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-field:
      title: FieldOptionsListControl
      required:
        - data_view_id
        - field_name
      type: object
      properties:
        data_view_id:
          minLength: 1
          type: string
          description: The ID of the data view that provides field options for this control.
        display_settings:
          type: object
          properties:
            hide_action_bar:
              type: boolean
              description: 'When `true`, the search bar, sorting options, and select all toggle are hidden from the control.'
            hide_exclude:
              type: boolean
              description: 'When `true`, the exclude mode toggle is hidden from the control.'
            hide_exists:
              type: boolean
              description: 'When `true`, the exists filter option is hidden from the control.'
            hide_sort:
              type: boolean
              description: 'When `true`, the sort selector is hidden from the control.'
            placeholder:
              type: string
              description: Placeholder text displayed in the control input when no option is selected.
          additionalProperties: false
        exclude:
          type: boolean
          description: 'When `true`, the control filters to documents that do NOT match the selected options. Defaults to `false`.'
          default: false
        exists_selected:
          type: boolean
          description: 'When `true`, the control filters to documents where the field exists, regardless of the field''s value. Defaults to `false`.'
          default: false
        field_name:
          minLength: 1
          type: string
          description: The name of the field in the data view that this control filters on.
        ignore_validations:
          type: boolean
          description: 'When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.'
          default: false
        run_past_timeout:
          type: boolean
          description: 'When `true`, the options list query continues running even if it exceeds the configured timeout threshold. Defaults to `false`.'
          default: false
        search_technique:
          anyOf:
            - enum:
                - prefix
              type: string
            - enum:
                - wildcard
              type: string
            - enum:
                - exact
              type: string
          description: 'The matching technique used when searching available options. `prefix` matches values starting with the search term, `wildcard` matches values containing the search term, and `exact` requires a complete match. Only applies to string and IP fields. Defaults to `wildcard`.'
          default: wildcard
        selected_options:
          maxItems: 10000
          type: array
          items:
            type:
              - number
              - string
            description: A selected option value. Accepts a string or a number.
          description: The list of currently selected option values.
          default: [ ]
        single_select:
          type: boolean
          description: 'When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `false`.'
          default: false
        sort:
          required:
            - by
            - direction
          type: object
          properties:
            by:
              enum:
                - _count
                - _key
              type: string
              description: The field used to sort the available options list. `_count` sorts by document count and `_key` sorts alphabetically by option value.
            direction:
              enum:
                - asc
                - desc
              type: string
              description: The sort direction. `asc` sorts ascending and `desc` sorts descending.
          additionalProperties: false
          description: 'Defines how the available options are sorted in the control popover. Defaults to `{ by: "_count", direction: "desc" }`.'
          default:
            by: _count
            direction: desc
        title:
          type: string
          description: A human-readable title for the control.
        use_global_filters:
          type: boolean
          description: 'When `true`, the control''s available options are narrowed by the page''s active filters.'
          default: true
        values_source:
          anyOf:
            - enum:
                - field
              type: string
          description: The source of the field options for this control. Defaults to `field` for legacy controls.
          default: field
      additionalProperties: false
      description: An options list control whose available options come from a data view field.
    Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values:
      title: STATIC_VALUES
      required:
        - selected_options
        - variable_name
        - variable_type
        - control_type
        - available_options
      type: object
      properties:
        available_options:
          maxItems: 1000
          type: array
          items:
            type: string
          description: A fixed list of option strings displayed in the control.
        control_type:
          enum:
            - STATIC_VALUES
          type: string
        display_settings:
          type: object
          properties:
            hide_action_bar:
              type: boolean
              description: 'When `true`, the search bar, sorting options, and select all toggle are hidden from the control.'
            hide_exclude:
              type: boolean
              description: 'When `true`, the exclude mode toggle is hidden from the control.'
            hide_exists:
              type: boolean
              description: 'When `true`, the exists filter option is hidden from the control.'
            hide_sort:
              type: boolean
              description: 'When `true`, the sort selector is hidden from the control.'
            placeholder:
              type: string
              description: Placeholder text displayed in the control input when no option is selected.
          additionalProperties: false
        selected_options:
          maxItems: 10000
          type: array
          items:
            type: string
          description: The list of currently selected option values.
        single_select:
          type: boolean
          description: 'When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `true`.'
          default: true
        title:
          type: string
          description: A human-readable title for the control.
        variable_name:
          type: string
          description: The name of the ES|QL variable that this control populates. The variable is referenced in ES|QL queries using the `?variable_name` syntax.
        variable_type:
          anyOf:
            - enum:
                - fields
              type: string
            - enum:
                - values
              type: string
            - enum:
                - functions
              type: string
            - enum:
                - time_literal
              type: string
            - enum:
                - multi_values
              type: string
          description: 'The ES|QL variable type that determines how the selected value is substituted into the query. Accepts `fields`, `values`, `functions`, `time_literal`, or `multi_values`.'
      additionalProperties: false
      description: An ES|QL variable control with a fixed list of selectable options defined directly in `available_options`.
    Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query:
      title: VALUES_FROM_QUERY
      required:
        - selected_options
        - variable_name
        - variable_type
        - control_type
        - esql_query
      type: object
      properties:
        control_type:
          enum:
            - VALUES_FROM_QUERY
          type: string
        display_settings:
          type: object
          properties:
            hide_action_bar:
              type: boolean
              description: 'When `true`, the search bar, sorting options, and select all toggle are hidden from the control.'
            hide_exclude:
              type: boolean
              description: 'When `true`, the exclude mode toggle is hidden from the control.'
            hide_exists:
              type: boolean
              description: 'When `true`, the exists filter option is hidden from the control.'
            hide_sort:
              type: boolean
              description: 'When `true`, the sort selector is hidden from the control.'
            placeholder:
              type: string
              description: Placeholder text displayed in the control input when no option is selected.
          additionalProperties: false
        esql_query:
          type: string
          description: An ES|QL query whose results populate the list of available options in the control popover.
        selected_options:
          maxItems: 10000
          type: array
          items:
            type: string
          description: The list of currently selected option values.
        single_select:
          type: boolean
          description: 'When `true`, only one option can be selected at a time. Selecting a new option deselects any previously selected option. Defaults to `true`.'
          default: true
        title:
          type: string
          description: A human-readable title for the control.
        variable_name:
          type: string
          description: The name of the ES|QL variable that this control populates. The variable is referenced in ES|QL queries using the `?variable_name` syntax.
        variable_type:
          anyOf:
            - enum:
                - fields
              type: string
            - enum:
                - values
              type: string
            - enum:
                - functions
              type: string
            - enum:
                - time_literal
              type: string
            - enum:
                - multi_values
              type: string
          description: 'The ES|QL variable type that determines how the selected value is substituted into the query. Accepts `fields`, `values`, `functions`, `time_literal`, or `multi_values`.'
      additionalProperties: false
      description: An ES|QL variable control whose selectable options are dynamically retrieved by running an ES|QL query.
    Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql:
      title: EsqlRangeSliderControl
      required:
        - values_source
        - esql_query
      type: object
      properties:
        esql_query:
          minLength: 1
          type: string
          description: The ES|QL query that provides field options for this control
        ignore_validations:
          type: boolean
          description: 'When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.'
          default: false
        step:
          minimum: 0
          type: number
          description: The step size between selectable range values.
          default: 1
        title:
          type: string
          description: A human-readable title for the control.
        use_global_filters:
          type: boolean
          description: 'When `true`, the control''s available options are narrowed by the page''s active filters.'
          default: true
        value:
          maxItems: 2
          minItems: 2
          type: array
          items:
            type: string
          description: 'The selected range as a two-element array of strings representing the lower and upper bound values, for example `["10", "50"]`.'
        values_source:
          enum:
            - esql
          type: string
      additionalProperties: false
      description: A range slider control whose values come from an ES|QL query's results.
    Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-field:
      title: FieldRangeSliderControl
      required:
        - data_view_id
        - field_name
      type: object
      properties:
        data_view_id:
          minLength: 1
          type: string
          description: The ID of the data view that provides field options for this control.
        field_name:
          minLength: 1
          type: string
          description: The name of the field in the data view that this control filters on.
        ignore_validations:
          type: boolean
          description: 'When `true`, the control skips selection validation and does not report which selections are responsible for returning zero results.'
          default: false
        step:
          minimum: 0
          type: number
          description: The step size between selectable range values.
          default: 1
        title:
          type: string
          description: A human-readable title for the control.
        use_global_filters:
          type: boolean
          description: 'When `true`, the control''s available options are narrowed by the page''s active filters.'
          default: true
        value:
          maxItems: 2
          minItems: 2
          type: array
          items:
            type: string
          description: 'The selected range as a two-element array of strings representing the lower and upper bound values, for example `["10", "50"]`.'
        values_source:
          anyOf:
            - enum:
                - field
              type: string
          description: The source of the field options for this control. Defaults to `field` for legacy controls.
          default: field
      additionalProperties: false
      description: A range slider control whose values come from a numeric data view field.
    Kibana_HTTP_APIs_kbn-dashboard-access-control:
      title: Access control
      type: object
      properties:
        access_mode:
          anyOf:
            - enum:
                - write_restricted
              type: string
            - enum:
                - default
              type: string
          description: Controls edit access to the dashboard. Set to `write_restricted` to prevent edits by users without explicit write permission. Defaults to `default` (all viewers can edit).
      additionalProperties: false
      description: Access control settings for the dashboard.
    Kibana_HTTP_APIs_kbn-dashboard-data:
      required:
        - title
      type: object
      properties:
        access_control:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-access-control'
        description:
          type: string
          description: A short description of the dashboard.
        esql_approximation:
          type: boolean
          description: 'When `true`, ES|QL visualizations that use `STATS` run with [approximate execution](https://www.elastic.co/docs/reference/query-languages/esql/esql-query-approximation) for faster, estimated results.'
        filters:
          maxItems: 500
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema'
          description: 'Filters applied across all panels, including pinned panels.'
        options:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-options'
        panels:
          maxItems: 1000
          type: array
          items:
            anyOf:
              - oneOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis'
                discriminator:
                  propertyName: type
                  mapping:
                    aiops_change_point_chart: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart'
                    aiops_log_rate_analysis: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis'
                    aiops_pattern_analysis: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis'
                    apm_service_map: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map'
                    custom_content: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content'
                    discover_session: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session'
                    esql_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control'
                    field_stats_table: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table'
                    image: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image'
                    links: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links'
                    markdown: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown'
                    ml_anomaly_charts: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts'
                    ml_anomaly_swimlane: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane'
                    ml_single_metric_viewer: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer'
                    options_list_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control'
                    range_slider_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control'
                    slo_alerts: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts'
                    slo_burn_rate: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate'
                    slo_error_budget: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget'
                    slo_overview: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview'
                    synthetics_monitors: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors'
                    synthetics_stats_overview: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview'
                    time_slider_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control'
                    vis: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-section'
          description: 'Panels and sections in the dashboard. Each entry is either a panel (with a `type` and `config`) or a collapsible section (with a `title`, `collapsed` state, and nested `panels`).'
        pinned_panels:
          maxItems: 100
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-esql-control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-options-list-control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-range-slider-control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-time-slider-control'
            discriminator:
              propertyName: type
              mapping:
                esql_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-esql-control'
                options_list_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-options-list-control'
                range_slider_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-range-slider-control'
                time_slider_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-controls-group-schema-time-slider-control'
          description: An array of control panels and their state in the control group.
        project_routing:
          type: string
          description: 'Controls [cross-project search](https://www.elastic.co/docs/explore-analyze/cross-project-search/cross-project-search-project-routing) behavior for this dashboard (Serverless only). Set to `_alias:_origin` to scope data to the current project, or `_alias:*` to search across all projects. When omitted, the space default applies.'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-query'
        refresh_interval:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-service-server-refreshIntervalSchema'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this dashboard.
          default: [ ]
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          minLength: 1
          type: string
          description: A human-readable title for the dashboard.
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-dropped-panel-warning:
      title: Dropped panel
      required:
        - type
        - message
        - panel_type
        - panel_config
      type: object
      properties:
        message:
          type: string
          description: Human-readable explanation of why the panel was dropped.
        panel_config:
          type: object
          additionalProperties: { }
          description: The original configuration of the dropped panel.
        panel_references:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
          description: Saved object references used by the dropped panel.
        panel_type:
          type: string
          description: The type identifier of the dropped panel.
        type:
          enum:
            - dropped_panel
          type: string
      additionalProperties: false
      description: A panel that was excluded from the response because its type is not supported by the API.
    Kibana_HTTP_APIs_kbn-dashboard-dropped-property-warning:
      title: Dropped property
      required:
        - type
        - message
        - key
      type: object
      properties:
        key:
          type: string
          description: The name of the property that was dropped.
        message:
          type: string
          description: Human-readable explanation of why the property was dropped.
        type:
          enum:
            - dropped_property
          type: string
        value:
          description: The original value of the property that was dropped.
      additionalProperties: false
      description: A property that was excluded from the response because it failed validation.
    Kibana_HTTP_APIs_kbn-dashboard-options:
      title: Options
      type: object
      properties:
        auto_apply_filters:
          type: boolean
          description: 'When `true`, control filter changes are applied automatically. When `false`, control filter changes are applied manually through the dashboard''s search update button. Defaults to `true`.'
          default: true
        hide_panel_borders:
          type: boolean
          description: 'When `true`, panel borders are hidden. Defaults to `false`.'
          default: false
        hide_panel_titles:
          type: boolean
          description: 'When `true`, panel titles are hidden. Defaults to `false`.'
          default: false
        sync_colors:
          type: boolean
          description: 'When `true`, colors are synchronized across panels that share a data source. Defaults to `false`.'
          default: false
        sync_cursor:
          type: boolean
          description: 'When `true`, the cursor position is synchronized across panels. Defaults to `true`.'
          default: true
        sync_tooltips:
          type: boolean
          description: 'When `true`, tooltips are synchronized across panels. Defaults to `false`.'
          default: false
        use_margins:
          type: boolean
          description: 'When `true`, panels are separated by a margin. Defaults to `true`.'
          default: true
      additionalProperties: false
      description: Display and behavior settings for the dashboard.
      default:
        auto_apply_filters: true
        hide_panel_borders: false
        hide_panel_titles: false
        sync_colors: false
        sync_cursor: true
        sync_tooltips: false
        use_margins: true
    Kibana_HTTP_APIs_kbn-dashboard-panel-grid:
      title: Panel grid
      required:
        - x
        - y
      type: object
      properties:
        h:
          minimum: 1
          type: number
          description: The height of the panel in grid units. Minimum `1`. Defaults to `15`.
          default: 15
        w:
          maximum: 48
          minimum: 1
          type: number
          description: 'The width of the panel in grid units. Minimum `1`, maximum `48`. Defaults to `24`.'
          default: 24
        x:
          type: number
          description: The x coordinate of the panel in grid units.
        y:
          type: number
          description: The y coordinate of the panel in grid units.
      additionalProperties: false
      description: The position and size of the panel on the dashboard grid.
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart:
      title: Change point detection chart
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_aiops_change_point_chart'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - aiops_change_point_chart
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis:
      title: Log rate analysis
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_aiops_log_rate_analysis'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - aiops_log_rate_analysis
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis:
      title: Pattern analysis
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_aiops_pattern_analysis'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - aiops_pattern_analysis
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map:
      title: APM Service map
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_apm-service-map-embeddable'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - apm_service_map
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content:
      title: Custom panel
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            esql_query:
              maxItems: 1
              type: array
              items:
                maxLength: 1000000
                type: string
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            template:
              maxLength: 510000
              type: string
            time_range:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
            title:
              type: string
              description: The panel title.
          additionalProperties: false
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - custom_content
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session:
      title: Discover session
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          anyOf:
            - title: By value
              required:
                - tabs
              type: object
              properties:
                description:
                  type: string
                  description: A short description of the panel.
                drilldowns:
                  maxItems: 100
                  type: array
                  items:
                    anyOf:
                      - title: url_drilldown
                        allOf:
                          - required:
                              - url
                            type: object
                            properties:
                              encode_url:
                                type: boolean
                                description: 'When true, URL is escaped using percent encoding'
                                default: true
                              open_in_new_tab:
                                type: boolean
                                default: true
                              url:
                                type: string
                                description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                            additionalProperties: false
                          - required:
                              - label
                              - trigger
                              - type
                            type: object
                            properties:
                              label:
                                type: string
                              trigger:
                                anyOf:
                                  - enum:
                                      - on_open_panel_menu
                                    type: string
                              type:
                                enum:
                                  - url_drilldown
                                type: string
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                tabs:
                  maxItems: 1
                  minItems: 1
                  type: array
                  items:
                    anyOf:
                      - required:
                          - data_source
                        type: object
                        properties:
                          column_order:
                            maxItems: 100
                            type: array
                            items:
                              type: string
                              description: Field name of a column in display order.
                            description: 'Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting "defaultColumns" or the referenced saved object.'
                          column_settings:
                            type: object
                            additionalProperties:
                              type: object
                              properties:
                                width:
                                  minimum: 0
                                  type: number
                                  description: Optional width of the column in pixels.
                              additionalProperties: false
                            description: Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in `column_order` when both are set.
                          data_source:
                            oneOf:
                              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
                              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
                            discriminator:
                              propertyName: type
                              mapping:
                                data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
                                data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
                          default_rendered_nodes:
                            maximum: 200
                            minimum: 10
                            type: number
                            description: 'Discover display option: controls how many nodes each JSON cell renders by default in JSON document view.'
                          density:
                            anyOf:
                              - enum:
                                  - compact
                                type: string
                              - enum:
                                  - expanded
                                type: string
                              - enum:
                                  - normal
                                type: string
                            description: 'Discover display option: controls table row spacing. Choose "compact", "expanded", or "normal". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference.'
                          documents_display_mode:
                            anyOf:
                              - enum:
                                  - table
                                type: string
                              - enum:
                                  - json
                                type: string
                            description: 'Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json").'
                          filters:
                            maxItems: 100
                            type: array
                            items:
                              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema'
                            description: List of filters to apply to the data in the tab.
                            default: [ ]
                          header_row_height:
                            anyOf:
                              - maximum: 5
                                minimum: 1
                                type: number
                              - enum:
                                  - auto
                                type: string
                            description: 'Discover display option: controls table header row height. Use a number (1–5) or "auto" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference.'
                          hide_nulls:
                            type: boolean
                            description: 'Discover display option: controls whether fields with null values are hidden in JSON document view.'
                          query:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-query'
                          row_height:
                            anyOf:
                              - maximum: 20
                                minimum: 1
                                type: number
                              - enum:
                                  - auto
                                type: string
                            description: 'Discover display option: controls table data row height. Use a number (1–20) or "auto" to size based on content. If omitted, defaults to the advanced setting "discover:rowHeightOption".'
                          rows_per_page:
                            maximum: 10000
                            minimum: 1
                            type: number
                            description: 'The number of rows to display per page in the data table. If omitted, defaults to the advanced setting "discover:sampleRowsPerPage".'
                          sample_size:
                            maximum: 10000
                            minimum: 10
                            type: number
                            description: 'Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting "discover:sampleSize".'
                          sort:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - name
                                - direction
                              type: object
                              properties:
                                direction:
                                  enum:
                                    - asc
                                    - desc
                                  type: string
                                  description: 'The direction to sort the field by: Use "asc" for ascending or "desc" for descending.'
                                name:
                                  type: string
                                  description: The name of the field to sort by.
                              additionalProperties: false
                            description: Sort configuration for the data table (field and direction).
                            default: [ ]
                          type:
                            enum:
                              - default
                            type: string
                            description: Identifies the type of profile settings saved with the tab. The `default` value indicates that no profile settings are included.
                            default: default
                          view_mode:
                            anyOf:
                              - enum:
                                  - documents
                                type: string
                              - enum:
                                  - patterns
                                type: string
                              - enum:
                                  - aggregated
                                type: string
                            description: 'Discover view mode. Choose "documents" (search hits), "patterns" (pattern analysis), or "aggregated" (field statistics).'
                            default: documents
                          wrap_lines:
                            type: boolean
                            description: 'Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line.'
                        additionalProperties: false
                      - required:
                          - data_source
                        type: object
                        properties:
                          column_order:
                            maxItems: 100
                            type: array
                            items:
                              type: string
                              description: Field name of a column in display order.
                            description: 'Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting "defaultColumns" or the referenced saved object.'
                          column_settings:
                            type: object
                            additionalProperties:
                              type: object
                              properties:
                                width:
                                  minimum: 0
                                  type: number
                                  description: Optional width of the column in pixels.
                              additionalProperties: false
                            description: Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in `column_order` when both are set.
                          data_source:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
                          default_rendered_nodes:
                            maximum: 200
                            minimum: 10
                            type: number
                            description: 'Discover display option: controls how many nodes each JSON cell renders by default in JSON document view.'
                          density:
                            anyOf:
                              - enum:
                                  - compact
                                type: string
                              - enum:
                                  - expanded
                                type: string
                              - enum:
                                  - normal
                                type: string
                            description: 'Discover display option: controls table row spacing. Choose "compact", "expanded", or "normal". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference.'
                          documents_display_mode:
                            anyOf:
                              - enum:
                                  - table
                                type: string
                              - enum:
                                  - json
                                type: string
                            description: 'Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json").'
                          header_row_height:
                            anyOf:
                              - maximum: 5
                                minimum: 1
                                type: number
                              - enum:
                                  - auto
                                type: string
                            description: 'Discover display option: controls table header row height. Use a number (1–5) or "auto" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference.'
                          hide_nulls:
                            type: boolean
                            description: 'Discover display option: controls whether fields with null values are hidden in JSON document view.'
                          row_height:
                            anyOf:
                              - maximum: 20
                                minimum: 1
                                type: number
                              - enum:
                                  - auto
                                type: string
                            description: 'Discover display option: controls table data row height. Use a number (1–20) or "auto" to size based on content. If omitted, defaults to the advanced setting "discover:rowHeightOption".'
                          rows_per_page:
                            maximum: 10000
                            minimum: 1
                            type: number
                            description: 'The number of rows to display per page in the data table. If omitted, defaults to the advanced setting "discover:sampleRowsPerPage".'
                          sample_size:
                            maximum: 10000
                            minimum: 10
                            type: number
                            description: 'Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting "discover:sampleSize".'
                          sort:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - name
                                - direction
                              type: object
                              properties:
                                direction:
                                  enum:
                                    - asc
                                    - desc
                                  type: string
                                  description: 'The direction to sort the field by: Use "asc" for ascending or "desc" for descending.'
                                name:
                                  type: string
                                  description: The name of the field to sort by.
                              additionalProperties: false
                            description: Sort configuration for the data table (field and direction).
                            default: [ ]
                          type:
                            enum:
                              - default
                            type: string
                            description: Identifies the type of profile settings saved with the tab. The `default` value indicates that no profile settings are included.
                            default: default
                          wrap_lines:
                            type: boolean
                            description: 'Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line.'
                        additionalProperties: false
                        description: ES|QL (Elasticsearch Query Language) data source.
                      - title: Metrics tab
                        required:
                          - data_source
                          - type
                          - dimensions
                          - search_term
                          - counter_aggregation
                          - gauge_aggregation
                          - histogram_percentile
                        type: object
                        properties:
                          column_order:
                            maxItems: 100
                            type: array
                            items:
                              type: string
                              description: Field name of a column in display order.
                            description: 'Ordered list of field names to display in the data table. If omitted, defaults to the advanced setting "defaultColumns" or the referenced saved object.'
                          column_settings:
                            type: object
                            additionalProperties:
                              type: object
                              properties:
                                width:
                                  minimum: 0
                                  type: number
                                  description: Optional width of the column in pixels.
                              additionalProperties: false
                            description: Per-column presentation settings keyed by field name (e.g. widths). Keys should correspond to entries in `column_order` when both are set.
                          counter_aggregation:
                            enum:
                              - avg
                              - sum
                              - min
                              - max
                            type: string
                            description: Aggregation applied to counter metric fields.
                          data_source:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
                          default_rendered_nodes:
                            maximum: 200
                            minimum: 10
                            type: number
                            description: 'Discover display option: controls how many nodes each JSON cell renders by default in JSON document view.'
                          density:
                            anyOf:
                              - enum:
                                  - compact
                                type: string
                              - enum:
                                  - expanded
                                type: string
                              - enum:
                                  - normal
                                type: string
                            description: 'Discover display option: controls table row spacing. Choose "compact", "expanded", or "normal". If omitted, Discover or the embedding application determines the density from its current settings, such as the user preference.'
                          dimensions:
                            maxItems: 5
                            type: array
                            items:
                              maxLength: 1000
                              type: string
                            description: Fields used to group metrics in the metrics grid.
                          documents_display_mode:
                            anyOf:
                              - enum:
                                  - table
                                type: string
                              - enum:
                                  - json
                                type: string
                            description: 'Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json").'
                          gauge_aggregation:
                            enum:
                              - avg
                              - sum
                              - min
                              - max
                            type: string
                            description: Aggregation applied to gauge metric fields.
                          header_row_height:
                            anyOf:
                              - maximum: 5
                                minimum: 1
                                type: number
                              - enum:
                                  - auto
                                type: string
                            description: 'Discover display option: controls table header row height. Use a number (1–5) or "auto" to size based on content. If omitted, Discover or the embedding application determines the height from its current settings, such as the user preference.'
                          hide_nulls:
                            type: boolean
                            description: 'Discover display option: controls whether fields with null values are hidden in JSON document view.'
                          histogram_percentile:
                            enum:
                              - p50
                              - p75
                              - p90
                              - p95
                              - p99
                            type: string
                            description: Percentile displayed for histogram metric fields.
                          row_height:
                            anyOf:
                              - maximum: 20
                                minimum: 1
                                type: number
                              - enum:
                                  - auto
                                type: string
                            description: 'Discover display option: controls table data row height. Use a number (1–20) or "auto" to size based on content. If omitted, defaults to the advanced setting "discover:rowHeightOption".'
                          rows_per_page:
                            maximum: 10000
                            minimum: 1
                            type: number
                            description: 'The number of rows to display per page in the data table. If omitted, defaults to the advanced setting "discover:sampleRowsPerPage".'
                          sample_size:
                            maximum: 10000
                            minimum: 10
                            type: number
                            description: 'Discover display option: controls how many documents to sample for the data table. If omitted, defaults to the advanced setting "discover:sampleSize".'
                          search_term:
                            maxLength: 1000
                            type: string
                            description: Search term used to filter metrics in the metrics grid.
                          sort:
                            maxItems: 100
                            type: array
                            items:
                              required:
                                - name
                                - direction
                              type: object
                              properties:
                                direction:
                                  enum:
                                    - asc
                                    - desc
                                  type: string
                                  description: 'The direction to sort the field by: Use "asc" for ascending or "desc" for descending.'
                                name:
                                  type: string
                                  description: The name of the field to sort by.
                              additionalProperties: false
                            description: Sort configuration for the data table (field and direction).
                            default: [ ]
                          type:
                            enum:
                              - metrics
                            type: string
                            description: A tab with saved metrics grid settings. Requires an ES|QL data source. These settings are used only when the query supports the metrics experience.
                          wrap_lines:
                            type: boolean
                            description: 'Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line.'
                        additionalProperties: false
                        description: An ES|QL tab with saved metrics grid settings. The dashboard panel stores these settings and restores them in Discover. The panel does not render the metrics grid.
                  description: Inline tab configuration. Used when no `ref_id` is set. Currently supports one tab.
                time_range:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored inline
            - title: By reference
              required:
                - ref_id
              type: object
              properties:
                description:
                  type: string
                  description: A short description of the panel.
                drilldowns:
                  maxItems: 100
                  type: array
                  items:
                    anyOf:
                      - title: url_drilldown
                        allOf:
                          - required:
                              - url
                            type: object
                            properties:
                              encode_url:
                                type: boolean
                                description: 'When true, URL is escaped using percent encoding'
                                default: true
                              open_in_new_tab:
                                type: boolean
                                default: true
                              url:
                                type: string
                                description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                            additionalProperties: false
                          - required:
                              - label
                              - trigger
                              - type
                            type: object
                            properties:
                              label:
                                type: string
                              trigger:
                                anyOf:
                                  - enum:
                                      - on_open_panel_menu
                                    type: string
                              type:
                                enum:
                                  - url_drilldown
                                type: string
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                overrides:
                  type: object
                  properties:
                    column_order:
                      maxItems: 100
                      type: array
                      items:
                        type: string
                        description: Field name of a column in display order.
                      description: 'When set, overrides column order for the data table relative to the referenced saved object (`ref_id`) or the inline tab in `tabs`. If omitted, the source configuration is used.'
                    column_settings:
                      type: object
                      additionalProperties:
                        type: object
                        properties:
                          width:
                            minimum: 0
                            type: number
                            description: Optional width of the column in pixels.
                        additionalProperties: false
                      description: 'Per-column presentation overrides (e.g. widths) keyed by field name. When set, merges with the source configuration for the referenced session or inline tab.'
                    default_rendered_nodes:
                      maximum: 200
                      minimum: 10
                      type: number
                      description: 'Discover display option: controls how many nodes each JSON cell renders by default in JSON document view. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used.'
                    density:
                      anyOf:
                        - enum:
                            - compact
                          type: string
                        - enum:
                            - expanded
                          type: string
                        - enum:
                            - normal
                          type: string
                      description: 'Discover display option: controls table row spacing (`compact`, `expanded`, or `normal`). When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used.'
                    documents_display_mode:
                      anyOf:
                        - enum:
                            - table
                          type: string
                        - enum:
                            - json
                          type: string
                      description: 'Discover display option: controls whether documents are shown as a formatted table ("table") or as a raw JSON tree ("json"). When set, overrides the referenced saved object or the inline tab config in `tabs`.'
                    header_row_height:
                      anyOf:
                        - maximum: 5
                          minimum: 1
                          type: number
                        - enum:
                            - auto
                          type: string
                      description: 'Discover display option: controls table header row height (number 1–5 or `auto`). When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used.'
                    hide_nulls:
                      type: boolean
                      description: 'Discover display option: controls whether fields with null values are hidden in JSON document view. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used.'
                    row_height:
                      anyOf:
                        - maximum: 20
                          minimum: 1
                          type: number
                        - enum:
                            - auto
                          type: string
                      description: 'Discover display option: controls table data row height (number 1–20 or `auto`). When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the advanced setting "discover:rowHeightOption".'
                    rows_per_page:
                      maximum: 10000
                      minimum: 1
                      type: number
                      description: 'Number of rows per page. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the advanced setting "discover:sampleRowsPerPage".'
                    sample_size:
                      maximum: 10000
                      minimum: 10
                      type: number
                      description: 'Discover display option: controls how many documents to sample. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, falls back to the source or to the advanced setting "discover:sampleSize".'
                    sort:
                      maxItems: 100
                      type: array
                      items:
                        required:
                          - name
                          - direction
                        type: object
                        properties:
                          direction:
                            enum:
                              - asc
                              - desc
                            type: string
                            description: 'The direction to sort the field by: Use "asc" for ascending or "desc" for descending.'
                          name:
                            type: string
                            description: The name of the field to sort by.
                        additionalProperties: false
                      description: 'Sort configuration (field and direction) for the data table. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used.'
                    wrap_lines:
                      type: boolean
                      description: 'Discover display option: controls whether long values wrap in JSON document view. When false, values are truncated to a single line. When set, overrides the referenced saved object or the inline tab config in `tabs`. If omitted, the source configuration is used.'
                  additionalProperties: false
                ref_id:
                  type: string
                selected_tab_id:
                  type: string
                  description: 'Tab to select from the referenced saved object. If omitted, defaults to the first tab.'
                time_range:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored in a linked library item
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - discover_session
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control:
      title: ES|QL variable control
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query'
          discriminator:
            propertyName: control_type
            mapping:
              STATIC_VALUES: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-static-values'
              VALUES_FROM_QUERY: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-esql-control-schema-values-from-query'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - esql_control
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table:
      title: Field statistics table
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_data_visualizer_field_stats'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - field_stats_table
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-image:
      title: Image
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          required:
            - image_config
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            drilldowns:
              maxItems: 100
              type: array
              items:
                anyOf:
                  - title: dashboard_drilldown
                    allOf:
                      - type: object
                        properties:
                          open_in_new_tab:
                            type: boolean
                            description: 'When enabled, the dashboard opens in a new browser tab.'
                            default: false
                          use_filters:
                            type: boolean
                            description: 'When enabled, filters are passed to the opening dashboard.'
                            default: true
                          use_time_range:
                            type: boolean
                            description: 'When enabled, time range is passed to the opening dashboard.'
                            default: true
                        additionalProperties: false
                        default:
                          open_in_new_tab: false
                          use_filters: true
                          use_time_range: true
                      - required:
                          - dashboard_id
                        type: object
                        properties:
                          dashboard_id:
                            type: string
                      - required:
                          - label
                          - trigger
                          - type
                        type: object
                        properties:
                          label:
                            type: string
                          trigger:
                            anyOf:
                              - enum:
                                  - on_click_image
                                type: string
                          type:
                            enum:
                              - dashboard_drilldown
                            type: string
                  - title: url_drilldown
                    allOf:
                      - required:
                          - url
                        type: object
                        properties:
                          encode_url:
                            type: boolean
                            description: 'When true, URL is escaped using percent encoding'
                            default: true
                          open_in_new_tab:
                            type: boolean
                            default: true
                          url:
                            type: string
                            description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                        additionalProperties: false
                      - required:
                          - label
                          - trigger
                          - type
                        type: object
                        properties:
                          label:
                            type: string
                          trigger:
                            anyOf:
                              - enum:
                                  - on_click_image
                                type: string
                              - enum:
                                  - on_open_panel_menu
                                type: string
                          type:
                            enum:
                              - url_drilldown
                            type: string
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            image_config:
              required:
                - src
              type: object
              properties:
                alt_text:
                  type: string
                background_color:
                  type: string
                object_fit:
                  anyOf:
                    - enum:
                        - fill
                      type: string
                    - enum:
                        - contain
                      type: string
                    - enum:
                        - cover
                      type: string
                    - enum:
                        - none
                      type: string
                  description: How the image should be sized within its container
                  default: contain
                src:
                  anyOf:
                    - title: file
                      required:
                        - type
                        - file_id
                      type: object
                      properties:
                        file_id:
                          type: string
                        type:
                          enum:
                            - file
                          type: string
                      additionalProperties: false
                    - title: url
                      required:
                        - type
                        - url
                      type: object
                      properties:
                        type:
                          enum:
                            - url
                          type: string
                        url:
                          type: string
                          description: URL of the image
                      additionalProperties: false
                  description: Image source
              additionalProperties: false
            title:
              type: string
              description: The panel title.
          additionalProperties: false
          description: Image embeddable schema
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - image
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-links:
      title: Links
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          anyOf:
            - title: By value
              required:
                - links
              type: object
              properties:
                description:
                  type: string
                  description: A short description of the panel.
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                layout:
                  enum:
                    - horizontal
                    - vertical
                  type: string
                  description: Whether to display the links in a horizontal or vertical layout.
                links:
                  maxItems: 100
                  type: array
                  items:
                    oneOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                    discriminator:
                      propertyName: type
                      mapping:
                        dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                        externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                  description: The list of links to display.
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored inline
            - title: By reference
              required:
                - ref_id
              type: object
              properties:
                description:
                  type: string
                  description: A short description of the panel.
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                ref_id:
                  title: Reference ID
                  type: string
                  description: The unique identifier of the links library item.
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored in a linked library item
          description: Links embeddable schema
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - links
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown:
      title: Markdown
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          anyOf:
            - title: By value
              required:
                - content
              type: object
              properties:
                content:
                  type: string
                  description: 'The Markdown text rendered by the panel. Supports GitHub-flavored Markdown, including headings, paragraphs, lists, links, images, tables, blockquotes, and code blocks. Use `\n` for line breaks within JSON strings.'
                description:
                  type: string
                  description: A short description of the panel.
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                settings:
                  type: object
                  properties:
                    open_links_in_new_tab:
                      type: boolean
                      description: Open links in a new browser tab.
                      default: true
                  additionalProperties: false
                  description: Display settings for the markdown panel.
                  default:
                    open_links_in_new_tab: true
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored inline
            - title: By reference
              required:
                - ref_id
              type: object
              properties:
                description:
                  type: string
                  description: A short description of the panel.
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                ref_id:
                  type: string
                  description: The unique identifier of the markdown library item.
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored in a linked library item
          description: Markdown panel config
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - markdown
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts:
      title: Anomaly charts
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_ml_anomaly_charts'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - ml_anomaly_charts
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane:
      title: Anomaly swim lane
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_ml_anomaly_swimlane'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - ml_anomaly_swimlane
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer:
      title: Single metric viewer
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_ml_single_metric_viewer'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - ml_single_metric_viewer
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control:
      title: Options list control
      required:
        - type
        - grid
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-field'
          discriminator:
            propertyName: values_source
            mapping:
              esql: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-options-list-dsl-control-schema-esql'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - options_list_control
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control:
      title: Range slider control
      required:
        - type
        - grid
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-field'
          discriminator:
            propertyName: values_source
            mapping:
              esql: '#/components/schemas/Kibana_HTTP_APIs_kbn-controls-schemas-range-slider-control-schema-esql'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - range_slider_control
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts:
      title: SLO alerts
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-alerts-embeddable'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - slo_alerts
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate:
      title: SLO burn rate
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-burn-rate-embeddable'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - slo_burn_rate
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget:
      title: SLO error budget
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-error-budget-embeddable'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - slo_error_budget
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview:
      title: SLO overview
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-single-overview-embeddable'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_slo-group-overview-embeddable'
          description: SLO Overview embeddable schema
          discriminator:
            propertyName: overview_mode
            mapping:
              groups: '#/components/schemas/Kibana_HTTP_APIs_slo-group-overview-embeddable'
              single: '#/components/schemas/Kibana_HTTP_APIs_slo-single-overview-embeddable'
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - slo_overview
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors:
      title: Synthetics monitors
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            filters:
              type: object
              properties:
                locations:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by monitor locations
                monitor_ids:
                  maxItems: 5000
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by monitor IDs
                monitor_types:
                  maxItems: 10
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by monitor types
                projects:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by project
                tags:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by tags
              additionalProperties: false
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            title:
              type: string
              description: The panel title.
            view:
              anyOf:
                - enum:
                    - cardView
                  type: string
                - enum:
                    - compactView
                  type: string
              description: View mode for the monitors embeddable (defaults to cardView)
          additionalProperties: false
          description: Synthetics monitors embeddable schema
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - synthetics_monitors
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview:
      title: Synthetics stats overview
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            drilldowns:
              maxItems: 100
              type: array
              items:
                anyOf:
                  - title: url_drilldown
                    allOf:
                      - required:
                          - url
                        type: object
                        properties:
                          encode_url:
                            type: boolean
                            description: 'When true, URL is escaped using percent encoding'
                            default: true
                          open_in_new_tab:
                            type: boolean
                            default: true
                          url:
                            type: string
                            description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                        additionalProperties: false
                      - required:
                          - label
                          - trigger
                          - type
                        type: object
                        properties:
                          label:
                            type: string
                          trigger:
                            anyOf:
                              - enum:
                                  - on_open_panel_menu
                                type: string
                          type:
                            enum:
                              - url_drilldown
                            type: string
            filters:
              type: object
              properties:
                locations:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by monitor locations
                monitor_ids:
                  maxItems: 5000
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by monitor IDs
                monitor_types:
                  maxItems: 10
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by monitor types
                projects:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by project
                tags:
                  maxItems: 100
                  type: array
                  items:
                    required:
                      - label
                      - value
                    type: object
                    properties:
                      label:
                        type: string
                        description: Display label for the filter option
                      value:
                        type: string
                        description: Value for the filter option
                    additionalProperties: false
                  description: Filter by tags
              additionalProperties: false
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            title:
              type: string
              description: The panel title.
          additionalProperties: false
          description: Synthetics stats overview embeddable schema
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - synthetics_stats_overview
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control:
      title: Time slider control
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          type: object
          properties:
            end_percentage_of_time_range:
              maximum: 1
              minimum: 0
              type: number
              description: 'The end of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.'
              default: 1
            is_anchored:
              type: boolean
              description: 'When `true`, the start of the time window is fixed at the beginning of the global time range. Only the end of the window can be adjusted. Defaults to `false`.'
              default: false
            start_percentage_of_time_range:
              maximum: 1
              minimum: 0
              type: number
              description: 'The start of the selected time window expressed as a fraction of the global time range, where `0` is the beginning and `1` is the end of the range.'
              default: 0
          additionalProperties: false
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - time_slider_control
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis:
      title: Visualization
      required:
        - type
        - grid
        - config
      type: object
      properties:
        config:
          anyOf:
            - title: By value
              allOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiConfig'
                - type: object
                  properties:
                    description:
                      type: string
                      description: A short description of the panel.
                    drilldowns:
                      maxItems: 100
                      type: array
                      items:
                        anyOf:
                          - title: dashboard_drilldown
                            allOf:
                              - type: object
                                properties:
                                  open_in_new_tab:
                                    type: boolean
                                    description: 'When enabled, the dashboard opens in a new browser tab.'
                                    default: false
                                  use_filters:
                                    type: boolean
                                    description: 'When enabled, filters are passed to the opening dashboard.'
                                    default: true
                                  use_time_range:
                                    type: boolean
                                    description: 'When enabled, time range is passed to the opening dashboard.'
                                    default: true
                                additionalProperties: false
                                default:
                                  open_in_new_tab: false
                                  use_filters: true
                                  use_time_range: true
                              - required:
                                  - dashboard_id
                                type: object
                                properties:
                                  dashboard_id:
                                    type: string
                              - required:
                                  - label
                                  - trigger
                                  - type
                                type: object
                                properties:
                                  label:
                                    type: string
                                  trigger:
                                    anyOf:
                                      - enum:
                                          - on_apply_filter
                                        type: string
                                  type:
                                    enum:
                                      - dashboard_drilldown
                                    type: string
                          - title: discover_drilldown
                            allOf:
                              - type: object
                                properties:
                                  open_in_new_tab:
                                    type: boolean
                                    default: true
                                additionalProperties: false
                              - required:
                                  - label
                                  - trigger
                                  - type
                                type: object
                                properties:
                                  label:
                                    type: string
                                  trigger:
                                    anyOf:
                                      - enum:
                                          - on_apply_filter
                                        type: string
                                  type:
                                    enum:
                                      - discover_drilldown
                                    type: string
                          - title: url_drilldown
                            allOf:
                              - required:
                                  - url
                                type: object
                                properties:
                                  encode_url:
                                    type: boolean
                                    description: 'When true, URL is escaped using percent encoding'
                                    default: true
                                  open_in_new_tab:
                                    type: boolean
                                    default: true
                                  url:
                                    type: string
                                    description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                                additionalProperties: false
                              - required:
                                  - label
                                  - trigger
                                  - type
                                type: object
                                properties:
                                  label:
                                    type: string
                                  trigger:
                                    anyOf:
                                      - enum:
                                          - on_click_row
                                        type: string
                                      - enum:
                                          - on_click_value
                                        type: string
                                      - enum:
                                          - on_open_panel_menu
                                        type: string
                                      - enum:
                                          - on_select_range
                                        type: string
                                  type:
                                    enum:
                                      - url_drilldown
                                    type: string
                    hide_border:
                      type: boolean
                      description: 'When true, the panel border is hidden. Defaults to false.'
                    hide_title:
                      type: boolean
                      description: 'When true, the panel title is hidden. Defaults to false.'
                    references:
                      type: array
                      items:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
                    time_range:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
                    title:
                      type: string
                      description: The panel title.
                  additionalProperties: false
              description: Panel configuration stored inline
            - title: By reference
              required:
                - ref_id
              type: object
              properties:
                description:
                  type: string
                  description: A short description of the panel.
                drilldowns:
                  maxItems: 100
                  type: array
                  items:
                    anyOf:
                      - title: dashboard_drilldown
                        allOf:
                          - type: object
                            properties:
                              open_in_new_tab:
                                type: boolean
                                description: 'When enabled, the dashboard opens in a new browser tab.'
                                default: false
                              use_filters:
                                type: boolean
                                description: 'When enabled, filters are passed to the opening dashboard.'
                                default: true
                              use_time_range:
                                type: boolean
                                description: 'When enabled, time range is passed to the opening dashboard.'
                                default: true
                            additionalProperties: false
                            default:
                              open_in_new_tab: false
                              use_filters: true
                              use_time_range: true
                          - required:
                              - dashboard_id
                            type: object
                            properties:
                              dashboard_id:
                                type: string
                          - required:
                              - label
                              - trigger
                              - type
                            type: object
                            properties:
                              label:
                                type: string
                              trigger:
                                anyOf:
                                  - enum:
                                      - on_apply_filter
                                    type: string
                              type:
                                enum:
                                  - dashboard_drilldown
                                type: string
                      - title: discover_drilldown
                        allOf:
                          - type: object
                            properties:
                              open_in_new_tab:
                                type: boolean
                                default: true
                            additionalProperties: false
                          - required:
                              - label
                              - trigger
                              - type
                            type: object
                            properties:
                              label:
                                type: string
                              trigger:
                                anyOf:
                                  - enum:
                                      - on_apply_filter
                                    type: string
                              type:
                                enum:
                                  - discover_drilldown
                                type: string
                      - title: url_drilldown
                        allOf:
                          - required:
                              - url
                            type: object
                            properties:
                              encode_url:
                                type: boolean
                                description: 'When true, URL is escaped using percent encoding'
                                default: true
                              open_in_new_tab:
                                type: boolean
                                default: true
                              url:
                                type: string
                                description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                            additionalProperties: false
                          - required:
                              - label
                              - trigger
                              - type
                            type: object
                            properties:
                              label:
                                type: string
                              trigger:
                                anyOf:
                                  - enum:
                                      - on_click_row
                                    type: string
                                  - enum:
                                      - on_click_value
                                    type: string
                                  - enum:
                                      - on_open_panel_menu
                                    type: string
                                  - enum:
                                      - on_select_range
                                    type: string
                              type:
                                enum:
                                  - url_drilldown
                                type: string
                hide_border:
                  type: boolean
                  description: 'When true, the panel border is hidden. Defaults to false.'
                hide_title:
                  type: boolean
                  description: 'When true, the panel title is hidden. Defaults to false.'
                ref_id:
                  type: string
                references:
                  type: array
                  items:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-content-management-utils-referenceSchema'
                time_range:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
                title:
                  type: string
                  description: The panel title.
              additionalProperties: false
              description: Panel configuration stored in a linked library item
          description: Lens embeddable schema
        grid:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-grid'
        id:
          type: string
          description: The unique ID of the panel.
        type:
          enum:
            - vis
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-dashboard-section:
      title: Section
      required:
        - title
        - grid
      type: object
      properties:
        collapsed:
          type: boolean
          description: 'When `true`, the section is collapsed and its panels are not rendered until expanded. Useful for improving initial load time on large dashboards. Defaults to `false`.'
          default: false
        grid:
          required:
            - y
          type: object
          properties:
            y:
              type: number
              description: The y coordinate of the section in grid units.
          additionalProperties: false
        id:
          type: string
          description: The unique ID of the section.
        panels:
          maxItems: 1000
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis'
            discriminator:
              propertyName: type
              mapping:
                aiops_change_point_chart: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_change_point_chart'
                aiops_log_rate_analysis: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_log_rate_analysis'
                aiops_pattern_analysis: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-aiops_pattern_analysis'
                apm_service_map: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-apm_service_map'
                custom_content: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-custom_content'
                discover_session: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-discover_session'
                esql_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-esql_control'
                field_stats_table: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-field_stats_table'
                image: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-image'
                links: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-links'
                markdown: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-markdown'
                ml_anomaly_charts: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_charts'
                ml_anomaly_swimlane: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_anomaly_swimlane'
                ml_single_metric_viewer: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-ml_single_metric_viewer'
                options_list_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-options_list_control'
                range_slider_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-range_slider_control'
                slo_alerts: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_alerts'
                slo_burn_rate: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_burn_rate'
                slo_error_budget: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_error_budget'
                slo_overview: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-slo_overview'
                synthetics_monitors: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_monitors'
                synthetics_stats_overview: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-synthetics_stats_overview'
                time_slider_control: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-time_slider_control'
                vis: '#/components/schemas/Kibana_HTTP_APIs_kbn-dashboard-panel-type-vis'
          description: The panels that belong to the section.
        title:
          type: string
          description: The title of the section.
      additionalProperties: false
      description: A collapsible group of panels.
    Kibana_HTTP_APIs_kbn-data-service-server-refreshIntervalSchema:
      title: Refresh interval
      required:
        - pause
        - value
      type: object
      properties:
        pause:
          type: boolean
          description: 'When `true`, auto-refresh is paused.'
        value:
          type: number
          description: The refresh interval in milliseconds.
      additionalProperties: false
      description: Specifies the auto-refresh interval for the object.
    Kibana_HTTP_APIs_kbn-data-view-field-setting:
      title: Field settings
      type: object
      properties:
        custom_description:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-description'
        custom_label:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-label'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format'
      additionalProperties: false
      description: 'Display overrides for a field. These settings can define a custom label, description, and format.'
    Kibana_HTTP_APIs_kbn-data-view-reference-schema:
      title: Data view reference
      required:
        - type
        - ref_id
      type: object
      properties:
        ref_id:
          type: string
          description: 'The id of the Kibana data view to use as the data source. Example: "my-data-view".'
        type:
          enum:
            - data_view_reference
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-data-view-spec-schema:
      title: Data view inline spec
      required:
        - type
        - index_pattern
      type: object
      properties:
        allow_hidden_indices:
          title: Allow hidden and system indices
          type: boolean
          description: 'When `true`, allows the data view to match hidden indices.'
        field_filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-filters-schema'
        field_settings:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-settings-entry'
        index_pattern:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-index-pattern-schema'
        name:
          title: Data view name
          maxLength: 256
          minLength: 1
          type: string
          description: 'The name of the data view. Example: "Sample data view".'
        time_field:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-time-field-schema'
        type:
          enum:
            - data_view_spec
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema:
      title: Time range
      required:
        - from
        - to
      type: object
      properties:
        from:
          type: string
          description: 'The start of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now-7d`) or ISO 8601 timestamps.'
        mode:
          anyOf:
            - enum:
                - absolute
              type: string
            - enum:
                - relative
              type: string
          description: 'The time range mode. Use `absolute` for fixed start and end timestamps. Use `relative` for [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions that are re-evaluated at query time (for example, `now-7d`).'
        to:
          type: string
          description: 'The end of the time range. Accepts Elasticsearch [date math](https://www.elastic.co/docs/reference/elasticsearch/rest-apis/common-options#date-math) expressions (for example, `now`) or ISO 8601 timestamps.'
      additionalProperties: false
      description: Specifies the time range for a query.
    Kibana_HTTP_APIs_kbn-field-custom-description:
      title: Custom description
      minLength: 1
      type: string
      description: 'Add a description to the field. It''s displayed next to the field on the Discover, Lens, and Data View Management pages.'
    Kibana_HTTP_APIs_kbn-field-custom-label:
      title: Custom label
      minLength: 1
      type: string
      description: 'Create a label to display in place of the field name in Discover, Maps, Lens, Visualize, and TSVB. Useful for shortening a long field name. Queries and filters use the original field name.'
    Kibana_HTTP_APIs_kbn-field-filters-schema:
      title: Field filters
      maxItems: 10000
      type: array
      items:
        maxLength: 1000
        minLength: 1
        type: string
      description: 'Field filters can be used to exclude one or more fields when fetching a document. They may contain wildcards, such as `user*` which filters fields starting with ''user''.'
    Kibana_HTTP_APIs_kbn-field-format:
      title: Format
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-boolean'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-bytes'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-color'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-currency'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-date_nanos'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-date'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-duration'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-geo_point'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-histogram'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-ip'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-number'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-percent'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-relative_date'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-static_lookup'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-string'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-truncate'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format-url'
        - title: Extensible format
          required:
            - type
          type: object
          properties:
            params: { }
            type:
              type: string
          additionalProperties: false
          description: Fallback for custom formatter IDs only. Known formatter IDs must match their dedicated schema and are validated at runtime.
      description: Set your preferred format for displaying the value. Changing the format can affect the value and prevent highlighting in Discover.
    Kibana_HTTP_APIs_kbn-field-format-boolean:
      title: Boolean field format
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - boolean
          type: string
      additionalProperties: false
      description: Formats a field into a true/false value.
    Kibana_HTTP_APIs_kbn-field-format-bytes:
      title: Bytes field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            pattern:
              title: Numeral pattern
              type: string
              description: Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
          additionalProperties: false
        type:
          enum:
            - bytes
          type: string
      additionalProperties: false
      description: Formats a field into a bytes value following the numeral.js format pattern. The default pattern is defined by the format:bytes:defaultPattern advanced setting.
    Kibana_HTTP_APIs_kbn-field-format-color:
      title: Color field format
      required:
        - type
        - params
      type: object
      properties:
        params:
          oneOf:
            - required:
                - field_type
                - colors
              type: object
              properties:
                colors:
                  type: array
                  items:
                    required:
                      - text
                      - background
                      - regex
                    type: object
                    properties:
                      background:
                        title: Background color
                        type: string
                        description: The background color to use for the field.
                      regex:
                        title: Regex
                        type: string
                        description: 'When the field type is a string, this regex is used to determine the color.'
                      text:
                        title: Text color
                        type: string
                        description: The text color to use for the field.
                field_type:
                  enum:
                    - string
                  type: string
              additionalProperties: false
            - required:
                - field_type
                - colors
              type: object
              properties:
                colors:
                  type: array
                  items:
                    required:
                      - text
                      - background
                      - range
                    type: object
                    properties:
                      background:
                        title: Background color
                        type: string
                        description: The background color to use for the field.
                      range:
                        title: Range
                        type: string
                        description: 'When the field type is a number, this range is used to determine the color.'
                      text:
                        title: Text color
                        type: string
                        description: The text color to use for the field.
                field_type:
                  enum:
                    - number
                  type: string
              additionalProperties: false
            - required:
                - field_type
                - colors
              type: object
              properties:
                colors:
                  type: array
                  items:
                    required:
                      - text
                      - background
                      - boolean
                    type: object
                    properties:
                      background:
                        title: Background color
                        type: string
                        description: The background color to use for the field.
                      boolean:
                        title: Boolean
                        type: boolean
                        description: 'When the field type is a boolean, this boolean is used to determine the color.'
                      text:
                        title: Text color
                        type: string
                        description: The text color to use for the field.
                field_type:
                  enum:
                    - boolean
                  type: string
              additionalProperties: false
          discriminator:
            propertyName: field_type
        type:
          enum:
            - color
          type: string
      additionalProperties: false
      description: Formats a field into a color value.
    Kibana_HTTP_APIs_kbn-field-format-currency:
      title: Currency field format
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - currency
          type: string
      additionalProperties: false
      description: Formats a field into a currency value. The format is determined by the pattern of the format:currency:defaultPattern advanced setting.
    Kibana_HTTP_APIs_kbn-field-format-date:
      title: Date field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            pattern:
              title: Moment.js pattern
              type: string
              description: Moment.js format pattern. See https://momentjs.com/ to learn more.
              default: 'MMM D, YYYY @ HH:mm:ss.SSS'
          additionalProperties: false
        type:
          enum:
            - date
          type: string
      additionalProperties: false
      description: Formats a field into a date value following the defined pattern.
    Kibana_HTTP_APIs_kbn-field-format-date_nanos:
      title: Date nanos field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            pattern:
              title: Moment.js pattern
              type: string
              description: Moment.js format pattern. See https://momentjs.com/ to learn more.
              default: 'MMM D, YYYY @ HH:mm:ss.SSSSSSSSS'
          additionalProperties: false
        type:
          enum:
            - date_nanos
          type: string
      additionalProperties: false
      description: Formats a field into a date nanos value following the defined pattern.
    Kibana_HTTP_APIs_kbn-field-format-duration:
      title: Duration field format
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - input_format
            - output_format
          type: object
          properties:
            include_space_with_suffix:
              title: Include space with suffix
              type: boolean
              description: 'When true or not provided, the formatted duration includes a space between the value and suffix. When false, no space is included.'
              default: true
            input_format:
              title: Input format
              anyOf:
                - title: Picoseconds
                  enum:
                    - picoseconds
                  type: string
                - title: Nanoseconds
                  enum:
                    - nanoseconds
                  type: string
                - title: Microseconds
                  enum:
                    - microseconds
                  type: string
                - title: Milliseconds
                  enum:
                    - milliseconds
                  type: string
                - title: Seconds
                  enum:
                    - seconds
                  type: string
                - title: Minutes
                  enum:
                    - minutes
                  type: string
                - title: Hours
                  enum:
                    - hours
                  type: string
                - title: Days
                  enum:
                    - days
                  type: string
                - title: Weeks
                  enum:
                    - weeks
                  type: string
                - title: Months
                  enum:
                    - months
                  type: string
                - title: Years
                  enum:
                    - years
                  type: string
              description: The unit of the field value before formatting.
            output_format:
              title: Output format
              anyOf:
                - title: Human-readable (approximate)
                  enum:
                    - humanize
                  type: string
                  description: 'Displays the duration in the largest whole unit that applies, rounded. For example: "2 hours" or "a day".'
                - title: Human-readable (precise)
                  enum:
                    - humanize_precise
                  type: string
                  description: 'Displays the duration in the largest whole unit that applies, with decimal precision. For example: "2.35 hours".'
                - title: Milliseconds
                  enum:
                    - as_milliseconds
                  type: string
                - title: Seconds
                  enum:
                    - as_seconds
                  type: string
                - title: Minutes
                  enum:
                    - as_minutes
                  type: string
                - title: Hours
                  enum:
                    - as_hours
                  type: string
                - title: Days
                  enum:
                    - as_days
                  type: string
                - title: Weeks
                  enum:
                    - as_weeks
                  type: string
                - title: Months
                  enum:
                    - as_months
                  type: string
                - title: Years
                  enum:
                    - as_years
                  type: string
              description: The unit to convert the field value into for display.
            output_precision:
              title: Output precision
              type: number
              description: The number of decimal places to display in the duration value.
              default: 2
            show_suffix:
              title: Show suffix
              type: boolean
              description: 'When true, the formatted duration includes a suffix (such as "seconds", "milliseconds", or "years"). When false or not provided, no suffix is shown.'
            use_short_suffix:
              title: Use short suffix
              type: boolean
              description: 'When true, the formatted duration uses short suffixes (such as "s", "ms", or "h"). When false or not provided, full suffixes are used.'
              default: false
          additionalProperties: false
        type:
          enum:
            - duration
          type: string
      additionalProperties: false
      description: Formats a field into a duration value.
    Kibana_HTTP_APIs_kbn-field-format-geo_point:
      title: Geo point field format
      required:
        - type
      type: object
      properties:
        params:
          required:
            - transform
          type: object
          properties:
            transform:
              title: Transform
              anyOf:
                - title: Lat lon string
                  enum:
                    - lat_lon_string
                  type: string
                  description: 'Transforms the geo point into a string in the format "latitude,longitude". For example "40.7128,-74.0060".'
                - title: WKT
                  enum:
                    - wkt
                  type: string
                  description: Transforms the geo point into a Well-Known Text (WKT) string. For example "POINT (123.456 78.901)".
                - title: DMS
                  enum:
                    - dms
                  type: string
                  description: 'Transforms the geo point into a string in the format "latitude,longitude (degrees, minutes, seconds)". For example "40°42′50.2″N 73°59′45.6″W".'
                - title: MGRS
                  enum:
                    - mgrs
                  type: string
                  description: 'Transforms the geo point into a string in the format "latitude,longitude (Military Grid Reference System)". For example "18SUJ1234567890".'
                - title: Multi
                  enum:
                    - multi
                  type: string
                  description: 'Transforms the geo point to all the previous formats. For example: "Lat Long: 40.7128,-74.0060, WKT: POINT (123.456 78.901), DMS: 40°42′50.2″N 73°59′45.6″W, MGRS: 18SUJ1234567890".'
              description: The transform to apply to the geo point value.
          additionalProperties: false
        type:
          enum:
            - geo_point
          type: string
      additionalProperties: false
      description: Formats a field into a geo point value.
    Kibana_HTTP_APIs_kbn-field-format-histogram:
      title: Histogram field format
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - format
          type: object
          properties:
            format:
              anyOf:
                - enum:
                    - bytes
                  type: string
                - enum:
                    - percent
                  type: string
                - enum:
                    - number
                  type: string
            pattern:
              title: Numeral pattern
              type: string
              description: Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
          additionalProperties: false
        type:
          enum:
            - histogram
          type: string
      additionalProperties: false
      description: 'Formats a histogram field into a numeric value following the defined pattern. The default pattern is defined by format:bytes:defaultPattern, format:percent:defaultPattern or format:number:defaultPattern advanced settings depending on the selected format.'
    Kibana_HTTP_APIs_kbn-field-format-ip:
      title: IP field format
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - ip
          type: string
      additionalProperties: false
      description: Formats a field into an IP address.
    Kibana_HTTP_APIs_kbn-field-format-number:
      title: Number field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            pattern:
              title: Numeral pattern
              type: string
              description: Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
          additionalProperties: false
        type:
          enum:
            - number
          type: string
      additionalProperties: false
      description: Formats a field into a numeric value following the defined pattern. The default pattern is defined by format:number:defaultPattern advanced setting.
    Kibana_HTTP_APIs_kbn-field-format-percent:
      title: Percent field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            pattern:
              title: Numeral pattern
              type: string
              description: Numeral.js format pattern. See https://www.elastic.co/docs/explore-analyze/numeral-formatting to learn more.
          additionalProperties: false
        type:
          enum:
            - percent
          type: string
      additionalProperties: false
      description: Formats a field into a percentage value following the defined pattern. The default pattern is defined by format:percent:defaultPattern advanced setting.
    Kibana_HTTP_APIs_kbn-field-format-relative_date:
      title: Relative date field format
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - relative_date
          type: string
      additionalProperties: false
      description: 'Formats a field into a relative date value. For example: "1 day ago".'
    Kibana_HTTP_APIs_kbn-field-format-static_lookup:
      title: Static lookup field format
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - lookup_entries
          type: object
          properties:
            lookup_entries:
              title: Lookup entries
              type: array
              items:
                required:
                  - key
                  - value
                type: object
                properties:
                  key:
                    type: string
                  value:
                    type: string
              description: 'The lookup entries to use for the static lookup. The key refers to the field value, and the value refers to the new value to display.'
            unknown_key_value:
              title: Unknown key value
              type: string
              description: 'The value to display for unknown key values. If not provided, the field value will be displayed.'
          additionalProperties: false
        type:
          enum:
            - static_lookup
          type: string
      additionalProperties: false
      description: Formats a field into a static value based on the lookup entries or the unknown key value.
    Kibana_HTTP_APIs_kbn-field-format-string:
      title: String field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            transform:
              anyOf:
                - title: Lower case
                  enum:
                    - lower
                  type: string
                  description: 'Converts the field value to lowercase. For example: "Some Text" -> "some text".'
                - title: Upper case
                  enum:
                    - upper
                  type: string
                  description: 'Converts the field value to uppercase. For example: "Some Text" -> "SOME TEXT".'
                - title: Title
                  enum:
                    - title
                  type: string
                  description: 'Converts the field value to title case. For example: "some text" -> "Some Text".'
                - title: Short dots
                  enum:
                    - short
                  type: string
                  description: 'Shortens each dot-separated segment of the field value to its first character, except for the last segment. For example: "dot.notated.string" -> "d.n.string".'
                - title: Base64 decode
                  enum:
                    - base64
                  type: string
                  description: 'Decodes the field value from base64. For example: "U29tZSBUZXh0" -> "Some Text".'
                - title: URL parameter decode
                  enum:
                    - urlparam
                  type: string
                  description: 'Decodes the field value from URL parameter. For example: "Some%20Text" -> "Some Text".'
          additionalProperties: false
        type:
          enum:
            - string
          type: string
      additionalProperties: false
      description: Formats a field into a string value.
    Kibana_HTTP_APIs_kbn-field-format-truncate:
      title: Truncate field format
      required:
        - type
      type: object
      properties:
        params:
          type: object
          properties:
            field_length:
              type: number
          additionalProperties: false
        type:
          enum:
            - truncate
          type: string
      additionalProperties: false
      description: 'Truncates the field value to the specified length. If the field value is longer than the specified length, it will be truncated and the remaining text will be replaced with "...".'
    Kibana_HTTP_APIs_kbn-field-format-url:
      title: URL field format
      required:
        - type
        - params
      type: object
      properties:
        params:
          oneOf:
            - required:
                - type
              type: object
              properties:
                label_template:
                  title: Label template
                  type: string
                  description: 'The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{url}}. For example: "{{value}}".'
                open_link_in_current_tab:
                  title: Open link in current tab
                  type: boolean
                  description: 'When true, the URL opens in the current tab. When false or not provided, the URL opens in a new tab.'
                type:
                  title: Link
                  enum:
                    - a
                  type: string
                  description: Displays the field value as a hyperlink.
                url_template:
                  title: URL template
                  type: string
                  description: 'The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{risonValue}}. Use {{risonValue}} when embedding the field value inside Kibana app URL rison state (for example: query:''{{risonValue}}''). For example: "https://example.com/{{value}}".'
              additionalProperties: false
            - required:
                - type
              type: object
              properties:
                height:
                  title: Height
                  type: number
                  description: 'The height of the image. If not provided, the image will be displayed at the original height.'
                label_template:
                  title: Label template
                  type: string
                  description: 'The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{url}}. For example: "{{value}}".'
                type:
                  title: Image
                  enum:
                    - img
                  type: string
                  description: Displays the field value as an image.
                url_template:
                  title: URL template
                  type: string
                  description: 'The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{risonValue}}. Use {{risonValue}} when embedding the field value inside Kibana app URL rison state (for example: query:''{{risonValue}}''). For example: "https://example.com/{{value}}".'
                width:
                  title: Width
                  type: number
                  description: 'The width of the image. If not provided, the image will be displayed at the original width.'
              additionalProperties: false
            - required:
                - type
              type: object
              properties:
                label_template:
                  title: Label template
                  type: string
                  description: 'The template to use for the label. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{url}}. For example: "{{value}}".'
                type:
                  title: Audio
                  enum:
                    - audio
                  type: string
                  description: Displays the field value as an audio player.
                url_template:
                  title: URL template
                  type: string
                  description: 'The template to use for the URL. The template is a string that contains the field value. The field value is replaced with the template. The available placeholders are: {{value}}, {{rawValue}} and {{risonValue}}. Use {{risonValue}} when embedding the field value inside Kibana app URL rison state (for example: query:''{{risonValue}}''). For example: "https://example.com/{{value}}".'
              additionalProperties: false
          discriminator:
            propertyName: type
        type:
          enum:
            - url
          type: string
      additionalProperties: false
      description: 'Formats a field into a link, image or audio.'
    Kibana_HTTP_APIs_kbn-field-settings-entry:
      title: Field settings or runtime field
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-composite-runtime-field-schema'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-schema'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-field-setting'
      description: 'Display overrides for an indexed field, or a runtime field definition when `type` is set to a runtime field kind.'
    Kibana_HTTP_APIs_kbn-index-pattern-schema:
      title: Index pattern
      minLength: 1
      type: string
      description: 'The index pattern (Elasticsearch index expression) to use as the data source. Example: "my-index-*".'
    Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink:
      required:
        - type
        - destination
      type: object
      properties:
        destination:
          type: string
          description: Linked dashboard saved object ID.
        label:
          type: string
          description: The label of the link displayed in the UI.
        options:
          type: object
          properties:
            open_in_new_tab:
              type: boolean
              description: 'When enabled, the dashboard opens in a new browser tab.'
              default: false
            use_filters:
              type: boolean
              description: 'When enabled, filters are passed to the opening dashboard.'
              default: true
            use_time_range:
              type: boolean
              description: 'When enabled, time range is passed to the opening dashboard.'
              default: true
          additionalProperties: false
          default:
            open_in_new_tab: false
            use_filters: true
            use_time_range: true
        type:
          enum:
            - dashboardLink
          type: string
      additionalProperties: false
      description: Link type. Set to dashboardLink for a link to another dashboard.
    Kibana_HTTP_APIs_kbn-link-type-externalLink:
      required:
        - type
        - destination
      type: object
      properties:
        destination:
          type: string
          description: The external URL to link to.
        label:
          type: string
          description: The label of the link displayed in the UI.
        options:
          type: object
          properties:
            encode_url:
              type: boolean
              description: Whether to escape the URL with percent encoding
              default: true
            open_in_new_tab:
              type: boolean
              description: Whether to open this link in a new tab when clicked.
              default: true
          additionalProperties: false
          default:
            encode_url: true
            open_in_new_tab: true
        type:
          enum:
            - externalLink
          type: string
      additionalProperties: false
      description: Link type. Set to externalLink for a URL outside Kibana.
    Kibana_HTTP_APIs_kbn-runtime-field-base-schema:
      title: Runtime field base
      required:
        - type
      type: object
      properties:
        custom_description:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-description'
        custom_label:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-label'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format'
        type:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-type'
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-runtime-field-schema:
      title: Runtime field
      required:
        - type
      type: object
      properties:
        custom_description:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-description'
        custom_label:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-custom-label'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-field-format'
        script:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-script'
        type:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-runtime-field-type'
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-runtime-field-script:
      title: Script
      minLength: 1
      type: string
      description: 'The script that defines the runtime field. This should be a painless script that computes the field value at query time. Runtime fields without a script retrieve values from _source. If the field doesn''t exist in _source, a search request returns no value.'
    Kibana_HTTP_APIs_kbn-runtime-field-type:
      title: Type
      enum:
        - keyword
        - long
        - double
        - date
        - ip
        - boolean
        - geo_point
      type: string
      description: 'The type of the runtime field (e.g., "keyword", "long", "date").'
    Kibana_HTTP_APIs_kbn-tags-attributes:
      required:
        - name
        - color
      type: object
      properties:
        color:
          maxLength: 256
          minLength: 1
          type: string
          description: 'The tag color as a hex value (e.g. `#772299`). If omitted, a random color is generated.'
        description:
          maxLength: 2048
          type: string
          description: Optional description of the tag.
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: The display name of the tag.
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-tags-request-attributes:
      required:
        - name
      type: object
      properties:
        color:
          maxLength: 256
          minLength: 1
          type: string
          description: 'The tag color as a hex value (e.g. `#772299`). If omitted, a random color is generated.'
        description:
          maxLength: 2048
          type: string
          description: Optional description of the tag.
        name:
          maxLength: 256
          minLength: 1
          type: string
          description: The display name of the tag.
      additionalProperties: false
    Kibana_HTTP_APIs_kbn-time-field-schema:
      title: Time field
      type: string
      description: 'The name of the time field in the index. Used for time-based filtering. Example: "@timestamp".'
    Kibana_HTTP_APIs_kibana_asset_reference:
      title: kibana_asset_reference
      required:
        - id
        - type
      type: object
      properties:
        deferred:
          type: boolean
        id:
          type: string
        originId:
          type: string
        type:
          anyOf:
            - enum:
                - dashboard
                - lens
                - visualization
                - search
                - index-pattern
                - map
                - ml-module
                - security-rule
                - csp-rule-template
                - osquery-pack-asset
                - osquery-saved-query
                - tag
              type: string
            - type: string
      additionalProperties: false
    Kibana_HTTP_APIs_legacyMetricLibItemNoESQL:
      title: Legacy Metric Chart (library)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          allOf:
            - anyOf:
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
            - type: object
              properties:
                apply_color_to:
                  enum:
                    - value
                    - background
                  type: string
                  description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                color:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValueAbsolute'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValuePalette'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegacyColorByValueAbsolute'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                  description: Color configuration based on the metric value.
                  default:
                    type: auto
                labels:
                  type: object
                  properties:
                    alignment:
                      enum:
                        - top
                        - bottom
                      type: string
                      description: Label alignment
                      default: top
                  additionalProperties: false
                  description: Labels configuration
                size:
                  anyOf:
                    - enum:
                        - xs
                      type: string
                    - enum:
                        - s
                      type: string
                    - enum:
                        - m
                      type: string
                    - enum:
                        - l
                      type: string
                    - enum:
                        - xl
                      type: string
                    - enum:
                        - xxl
                      type: string
                  description: Font size for the label and value
                  default: m
                values:
                  type: object
                  properties:
                    alignment:
                      enum:
                        - left
                        - center
                        - right
                      type: string
                      description: Value alignment
                      default: left
                  additionalProperties: false
                  description: Values configuration
              additionalProperties: false
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - legacy_metric
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_lensApiConfigLibItemNoESQL:
      title: Library Visualization Item
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_metricLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_legacyMetricLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_xyLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_gaugeLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_heatmapLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_tagcloudLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_regionMapLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_datatableLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_pieLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_mosaicLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_treemapLibItemNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_waffleLibItemNoESQL'
    Kibana_HTTP_APIs_LinksItemResponse:
      required:
        - id
        - data
        - meta
      type: object
      properties:
        data:
          required:
            - links
            - title
          type: object
          properties:
            description:
              type: string
            layout:
              enum:
                - horizontal
                - vertical
              type: string
              description: Whether to display the links in a horizontal or vertical layout.
            links:
              maxItems: 100
              type: array
              items:
                oneOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
                discriminator:
                  propertyName: type
                  mapping:
                    dashboardLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-panel-type-dashboardLink'
                    externalLink: '#/components/schemas/Kibana_HTTP_APIs_kbn-link-type-externalLink'
              description: The list of links to display.
            tags:
              maxItems: 1000
              type: array
              items:
                maxLength: 250
                type: string
              description: Tag IDs associated with this library item.
              default: [ ]
            title:
              type: string
          additionalProperties: false
        id:
          maxLength: 250
          type: string
          description: 'The unique ID of the links library item, as returned by the create or search endpoints.'
        meta:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
      additionalProperties: false
      description: Response containing a links library item with metadata.
    Kibana_HTTP_APIs_logs-alert-document-count-create-rule-body-alerting:
      title: Log threshold
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Log Threshold Rule Params
          anyOf:
            - required:
                - criteria
                - count
                - timeUnit
                - timeSize
                - logView
              type: object
              properties:
                count:
                  required:
                    - comparator
                    - value
                  type: object
                  properties:
                    comparator:
                      enum:
                        - more than
                        - more than or equals
                        - less than
                        - less than or equals
                        - equals
                        - does not equal
                        - matches
                        - does not match
                        - matches phrase
                        - does not match phrase
                      type: string
                    value:
                      type: number
                  additionalProperties: false
                criteria:
                  type: array
                  items:
                    required:
                      - field
                      - comparator
                      - value
                    type: object
                    properties:
                      comparator:
                        enum:
                          - more than
                          - more than or equals
                          - less than
                          - less than or equals
                          - equals
                          - does not equal
                          - matches
                          - does not match
                          - matches phrase
                          - does not match phrase
                        type: string
                      field:
                        type: string
                      value:
                        type:
                          - number
                          - string
                    additionalProperties: false
                groupBy:
                  type: array
                  items:
                    type: string
                logView:
                  required:
                    - logViewId
                    - type
                  type: object
                  properties:
                    logViewId:
                      type: string
                    type:
                      enum:
                        - log-view-reference
                      type: string
                  additionalProperties: false
                timeSize:
                  type: number
                timeUnit:
                  enum:
                    - s
                    - m
                    - h
                    - d
                  type: string
              additionalProperties: false
            - required:
                - criteria
                - count
                - timeUnit
                - timeSize
                - logView
              type: object
              properties:
                count:
                  required:
                    - comparator
                    - value
                  type: object
                  properties:
                    comparator:
                      enum:
                        - more than
                        - more than or equals
                        - less than
                        - less than or equals
                        - equals
                        - does not equal
                        - matches
                        - does not match
                        - matches phrase
                        - does not match phrase
                      type: string
                    value:
                      type: number
                  additionalProperties: false
                criteria:
                  maxItems: 2
                  minItems: 2
                  type: array
                  items:
                    type: array
                    items:
                      required:
                        - field
                        - comparator
                        - value
                      type: object
                      properties:
                        comparator:
                          enum:
                            - more than
                            - more than or equals
                            - less than
                            - less than or equals
                            - equals
                            - does not equal
                            - matches
                            - does not match
                            - matches phrase
                            - does not match phrase
                          type: string
                        field:
                          type: string
                        value:
                          type:
                            - number
                            - string
                      additionalProperties: false
                groupBy:
                  type: array
                  items:
                    type: string
                logView:
                  required:
                    - logViewId
                    - type
                  type: object
                  properties:
                    logViewId:
                      type: string
                    type:
                      enum:
                        - log-view-reference
                      type: string
                  additionalProperties: false
                timeSize:
                  type: number
                timeUnit:
                  enum:
                    - s
                    - m
                    - h
                    - d
                  type: string
              additionalProperties: false
          description: The parameters for the log threshold rule. These parameters are appropriate when `rule_type_id` is `logs.alert.document.count`.
        rule_type_id:
          enum:
            - logs.alert.document.count
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_maintenance_window_response:
      title: maintenance_window_response
      required:
        - id
        - title
        - enabled
        - created_at
        - updated_at
        - status
        - schedule
      type: object
      properties:
        created_at:
          type: string
          description: The date and time when the maintenance window was created.
        created_by:
          type:
            - 'null'
            - string
          description: The identifier for the user that created the maintenance window.
          default: 'null'
        enabled:
          type: boolean
          description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
        id:
          type: string
          description: The identifier for the maintenance window.
        schedule:
          required:
            - custom
          type: object
          properties:
            custom:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_response'
          additionalProperties: false
        scope:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_scope'
        status:
          enum:
            - running
            - upcoming
            - finished
            - archived
            - disabled
          type: string
          description: The current status of the maintenance window.
        title:
          type: string
          description: The name of the maintenance window.
        updated_at:
          type: string
          description: The date and time when the maintenance window was last updated.
        updated_by:
          type:
            - 'null'
            - string
          description: The identifier for the user that last updated this maintenance window.
          default: 'null'
      additionalProperties: false
    Kibana_HTTP_APIs_maintenance_window_schedule_recurring_request:
      title: maintenance_window_schedule_recurring_request
      type: object
      properties:
        end:
          maxLength: 100
          type: string
          description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
        every:
          maxLength: 100
          type: string
          description: 'The interval and frequency of a recurring schedule. It allows values in `<integer><unit>` format. `<unit>` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
        occurrences:
          minimum: 1
          type: number
          description: The total number of recurrences of the schedule.
        onMonth:
          maxItems: 12
          minItems: 1
          type: array
          items:
            maximum: 12
            minimum: 1
            type: number
          description: The specific months for a recurring schedule. Valid values are 1-12.
        onMonthDay:
          maxItems: 31
          minItems: 1
          type: array
          items:
            maximum: 31
            minimum: -1
            type: number
          description: 'The specific days of the month for a recurring schedule. Valid values are `1` to `31`, or `-1` for the last day of the month.'
        onWeekDay:
          maxItems: 77
          minItems: 1
          type: array
          items:
            maxLength: 10
            type: string
          description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
      additionalProperties: false
    Kibana_HTTP_APIs_maintenance_window_schedule_recurring_response:
      title: maintenance_window_schedule_recurring_response
      type: object
      properties:
        end:
          type: string
          description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
        every:
          type: string
          description: 'The interval and frequency of a recurring schedule. It allows values in `<integer><unit>` format. `<unit>` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
        occurrences:
          type: number
          description: The total number of recurrences of the schedule.
        onMonth:
          maxItems: 12
          type: array
          items:
            type: number
          description: The specific months for a recurring schedule. Valid values are 1-12.
        onMonthDay:
          maxItems: 31
          type: array
          items:
            type: number
          description: 'The specific days of the month for a recurring schedule. Valid values are `1` to `31`, or `-1` for the last day of the month.'
        onWeekDay:
          maxItems: 77
          type: array
          items:
            maxLength: 10
            type: string
          description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
      additionalProperties: false
    Kibana_HTTP_APIs_maintenance_window_schedule_request:
      title: maintenance_window_schedule_request
      required:
        - start
        - duration
      type: object
      properties:
        duration:
          maxLength: 100
          type: string
          description: 'The duration of the schedule. It allows values in `<integer><unit>` format. `<unit>` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
        recurring:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_recurring_request'
        start:
          maxLength: 100
          type: string
          description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
        timezone:
          maxLength: 64
          type: string
          description: The timezone of the schedule. The default timezone is UTC.
      additionalProperties: false
    Kibana_HTTP_APIs_maintenance_window_schedule_response:
      title: maintenance_window_schedule_response
      required:
        - start
        - duration
      type: object
      properties:
        duration:
          type: string
          description: 'The duration of the schedule. It allows values in `<integer><unit>` format. `<unit>` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
        recurring:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_recurring_response'
        start:
          type: string
          description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
        timezone:
          type: string
          description: The timezone of the schedule. The default timezone is UTC.
      additionalProperties: false
    Kibana_HTTP_APIs_maintenance_window_scope:
      title: maintenance_window_scope
      required:
        - alerting
      type: object
      properties:
        alerting:
          required:
            - query
          type: object
          properties:
            query:
              required:
                - kql
              type: object
              properties:
                kql:
                  type: string
                  description: A filter written in Kibana Query Language (KQL). Only alerts matching this query will be suppressed by the maintenance window.
              additionalProperties: false
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_managed_integration:
      title: managed_integration
      required:
        - id
        - name
        - package
        - inputs
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 1000
          type: array
          items:
            maxLength: 256
            type: string
          description: Additional data stream permissions granted to the managed integration.
        cloud_connector:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_cloud_connector'
        created_at:
          maxLength: 64
          type: string
          description: Creation timestamp (ISO 8601).
        created_by:
          maxLength: 1024
          type: string
          description: User who created the policy.
        description:
          maxLength: 2048
          type: string
          description: Managed integration description.
        global_data_tags:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                maxLength: 1024
                type: string
                description: The name of the custom field.
              value:
                anyOf:
                  - maxLength: 1024
                    type: string
                  - type: number
                description: The value of the custom field.
            additionalProperties: false
          description: Custom data tags applied to all data produced by this policy.
        id:
          maxLength: 255
          type: string
          description: Managed integration unique identifier.
        inputs:
          type: object
          additionalProperties:
            type: object
            properties:
              condition:
                maxLength: 10000
                type:
                  - 'null'
                  - string
                description: Agent condition expression to evaluate whether to apply this input.
              deprecated:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info'
              enabled:
                type: boolean
                description: Enable or disable that input. Defaults to `true` (enabled).
              streams:
                type: object
                additionalProperties:
                  type: object
                  properties:
                    condition:
                      maxLength: 10000
                      type:
                        - 'null'
                        - string
                      description: Agent condition expression to evaluate whether to apply this stream.
                    deprecated:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info'
                    enabled:
                      type: boolean
                      description: Enable or disable that stream. Defaults to `true` (enabled).
                    var_group_selections:
                      type: object
                      additionalProperties:
                        maxLength: 1024
                        type: string
                      description: Variable group selections. Maps var_group name to the selected option name within that group.
                    vars:
                      type: object
                      additionalProperties:
                        anyOf:
                          - maxLength: 10000
                            type: string
                          - type: number
                          - type: boolean
                          - maxItems: 100
                            type: array
                            items:
                              maxLength: 10000
                              type: string
                          - maxItems: 100
                            type: array
                            items:
                              type: number
                          - required:
                              - id
                              - isSecretRef
                            type: object
                            properties:
                              id:
                                maxLength: 255
                                type: string
                              isSecretRef:
                                type: boolean
                            additionalProperties: false
                        default: 'null'
                      description: Input/stream level variable. Refer to the integration documentation for more information.
                  additionalProperties: false
                description: Input streams. Refer to the integration documentation to know which streams are available.
              vars:
                type: object
                additionalProperties:
                  anyOf:
                    - maxLength: 10000
                      type: string
                    - type: number
                    - type: boolean
                    - maxItems: 100
                      type: array
                      items:
                        maxLength: 10000
                        type: string
                    - maxItems: 100
                      type: array
                      items:
                        type: number
                    - required:
                        - id
                        - isSecretRef
                      type: object
                      properties:
                        id:
                          maxLength: 255
                          type: string
                        isSecretRef:
                          type: boolean
                      additionalProperties: false
                  default: 'null'
                description: Input/stream level variable. Refer to the integration documentation for more information.
            additionalProperties: false
          description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
        name:
          maxLength: 255
          type: string
          description: Managed integration name.
        namespace:
          maxLength: 100
          type: string
          description: Policy namespace. Defaults to the agent policy namespace.
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration_package'
        updated_at:
          maxLength: 64
          type: string
          description: Last update timestamp (ISO 8601).
        updated_by:
          maxLength: 1024
          type: string
          description: User who last updated the policy.
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          type: object
          additionalProperties:
            anyOf:
              - maxLength: 10000
                type: string
              - type: number
              - type: boolean
              - maxItems: 100
                type: array
                items:
                  maxLength: 10000
                  type: string
              - maxItems: 100
                type: array
                items:
                  type: number
              - required:
                  - id
                  - isSecretRef
                type: object
                properties:
                  id:
                    maxLength: 255
                    type: string
                  isSecretRef:
                    type: boolean
                additionalProperties: false
            default: 'null'
          description: Input/stream level variable. Refer to the integration documentation for more information.
      additionalProperties: false
    Kibana_HTTP_APIs_managed_integration_cloud_connector:
      title: managed_integration_cloud_connector
      required:
        - enabled
        - cloud_connector_id
      type: object
      properties:
        cloud_connector_id:
          maxLength: 255
          type: string
          description: The ID of the cloud connector.
        enabled:
          type: boolean
          description: Whether the cloud connector is active for this policy.
      additionalProperties: false
    Kibana_HTTP_APIs_managed_integration_package:
      title: managed_integration_package
      required:
        - name
        - title
        - version
      type: object
      properties:
        name:
          maxLength: 255
          type: string
          description: Integration package name.
        title:
          maxLength: 255
          type: string
          description: Integration package display title.
        version:
          maxLength: 50
          type: string
          description: Integration package version.
      additionalProperties: false
    Kibana_HTTP_APIs_managed_integration_response:
      title: managed_integration_response
      required:
        - item
      type: object
      properties:
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
      additionalProperties: false
    Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_request:
      title: managed_integration_upgrade_dry_run_request
      required:
        - policyIds
      type: object
      properties:
        pkgVersion:
          maxLength: 256
          type: string
          description: Target package version to preview the upgrade against. Defaults to the installed package version.
        policyIds:
          maxItems: 1000
          type: array
          items:
            maxLength: 256
            type: string
          description: IDs of the managed integrations to preview upgrading.
      additionalProperties: false
    Kibana_HTTP_APIs_managed_integration_upgrade_dry_run_result:
      title: managed_integration_upgrade_dry_run_result
      required:
        - id
        - hasErrors
      type: object
      properties:
        body:
          required:
            - message
          type: object
          properties:
            message:
              maxLength: 4096
              type: string
              description: Error message when the dry-run failed for this policy.
          additionalProperties: false
        currentVersion:
          maxLength: 256
          type: string
          description: The current installed package version of the policy.
        errors:
          maxItems: 1000
          type: array
          items:
            required:
              - message
            type: object
            properties:
              message:
                maxLength: 4096
                type: string
                description: Human-readable migration error.
            additionalProperties: false
          description: Migration errors encountered while computing the upgrade.
        hasErrors:
          type: boolean
          description: Whether the dry-run migration produced any errors.
        id:
          maxLength: 256
          type: string
          description: The ID of the managed integration.
        name:
          maxLength: 256
          type: string
          description: The name of the managed integration.
        proposedPolicy:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_managed_integration'
        proposedVersion:
          maxLength: 256
          type: string
          description: The package version the policy would be upgraded to.
        statusCode:
          type: number
          description: HTTP-like status code when the dry-run failed for this policy.
      additionalProperties: false
    Kibana_HTTP_APIs_metricLibItemNoESQL:
      title: Metric Chart (library)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        breakdown_by:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                collapse_by:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                columns:
                  type: number
                  description: Number of columns.
                  default: 3
              additionalProperties: false
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metrics:
          maxItems: 2
          minItems: 1
          type: array
          items:
            anyOf:
              - allOf:
                  - anyOf:
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  - required:
                      - type
                    type: object
                    properties:
                      apply_color_to:
                        enum:
                          - value
                          - background
                        type: string
                        description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                      background_chart:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryViz'
                      color:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                        description: Color configuration for the primary metric value or background.
                        default:
                          type: auto
                      subtitle:
                        type: string
                        description: Subtitle below the primary metric value.
                      type:
                        enum:
                          - primary
                        type: string
              - allOf:
                  - anyOf:
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  - required:
                      - type
                    type: object
                    properties:
                      color:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNoColor'
                        default:
                          type: none
                      compare:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToBaseline'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToPrimary'
                        description: Compare the secondary metric to a baseline value or to the primary metric.
                      type:
                        enum:
                          - secondary
                        type: string
          description: Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - metric
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_metrics-alert-inventory-threshold-create-rule-body-alerting:
      title: Metric inventory threshold
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Metric Inventory Threshold Rule Params
          required:
            - criteria
            - nodeType
            - sourceId
          type: object
          properties:
            alertOnNoData:
              type: boolean
            criteria:
              type: array
              items:
                required:
                  - threshold
                  - comparator
                  - timeUnit
                  - timeSize
                  - metric
                type: object
                properties:
                  comparator:
                    type: string
                  customMetric:
                    required:
                      - type
                      - id
                      - field
                      - aggregation
                    type: object
                    properties:
                      aggregation:
                        type: string
                      field:
                        type: string
                      id:
                        type: string
                      label:
                        type: string
                      type:
                        enum:
                          - custom
                        type: string
                    additionalProperties: false
                  metric:
                    type: string
                  threshold:
                    type: array
                    items:
                      type: number
                  timeSize:
                    type: number
                  timeUnit:
                    type: string
                  warningComparator:
                    type: string
                  warningThreshold:
                    type: array
                    items:
                      type: number
                additionalProperties: false
            filterQuery:
              type: string
            nodeType:
              type: string
            schema:
              type: string
            sourceId:
              type: string
          description: The parameters for the metric inventory threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.inventory.threshold`.
        rule_type_id:
          enum:
            - metrics.alert.inventory.threshold
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_metrics-alert-threshold-create-rule-body-alerting:
      title: Metric threshold
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Metric Threshold Rule Params
          required:
            - criteria
            - sourceId
          type: object
          properties:
            alertOnGroupDisappear:
              type: boolean
              description: 'If true, an alert occurs if a group that previously reported metrics does not report them again over the expected time period. This check is not recommended for dynamically scaling infrastructures that might rapidly start and stop nodes automatically.'
            alertOnNoData:
              type: boolean
              description: 'If true, an alert occurs if the metrics do not report any data over the expected period or if the query fails.'
            criteria:
              type: array
              items:
                anyOf:
                  - required:
                      - threshold
                      - comparator
                      - timeUnit
                      - timeSize
                      - aggType
                    type: object
                    properties:
                      aggType:
                        enum:
                          - count
                        type: string
                      comparator:
                        type: string
                      threshold:
                        type: array
                        items:
                          type: number
                        description: 'The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.'
                      timeSize:
                        type: number
                        description: 'The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
                      timeUnit:
                        type: string
                        description: 'The type of units for the time window: seconds, minutes, hours, or days.'
                      warningComparator:
                        type: string
                      warningThreshold:
                        type: array
                        items:
                          type: number
                          description: 'The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.'
                    additionalProperties: false
                  - required:
                      - threshold
                      - comparator
                      - timeUnit
                      - timeSize
                      - metric
                      - aggType
                    type: object
                    properties:
                      aggType:
                        type: string
                      comparator:
                        type: string
                      metric:
                        type: string
                      threshold:
                        type: array
                        items:
                          type: number
                        description: 'The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.'
                      timeSize:
                        type: number
                        description: 'The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
                      timeUnit:
                        type: string
                        description: 'The type of units for the time window: seconds, minutes, hours, or days.'
                      warningComparator:
                        type: string
                      warningThreshold:
                        type: array
                        items:
                          type: number
                          description: 'The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.'
                    additionalProperties: false
                  - required:
                      - threshold
                      - comparator
                      - timeUnit
                      - timeSize
                      - aggType
                      - customMetrics
                    type: object
                    properties:
                      aggType:
                        enum:
                          - custom
                        type: string
                      comparator:
                        type: string
                      customMetrics:
                        type: array
                        items:
                          anyOf:
                            - required:
                                - name
                                - aggType
                                - field
                              type: object
                              properties:
                                aggType:
                                  type: string
                                field:
                                  type: string
                                name:
                                  type: string
                              additionalProperties: false
                            - required:
                                - name
                                - aggType
                              type: object
                              properties:
                                aggType:
                                  enum:
                                    - count
                                  type: string
                                filter:
                                  type: string
                                name:
                                  type: string
                              additionalProperties: false
                      equation:
                        type: string
                      label:
                        type: string
                      threshold:
                        type: array
                        items:
                          type: number
                        description: 'The threshold value that is used with the `comparator`. If the `comparator` is `between`, you must specify the boundary values.'
                      timeSize:
                        type: number
                        description: 'The size of the time window (in `timeUnit` units), which determines how far back to search for documents. Generally it should be a value higher than the rule check interval to avoid gaps in detection.'
                      timeUnit:
                        type: string
                        description: 'The type of units for the time window: seconds, minutes, hours, or days.'
                      warningComparator:
                        type: string
                      warningThreshold:
                        type: array
                        items:
                          type: number
                          description: 'The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.'
                    additionalProperties: false
            filterQuery:
              type: string
              description: A query that limits the scope of the rule. The rule evaluates only metric data that matches the query.
            groupBy:
              anyOf:
                - type: string
                - type: array
                  items:
                    type: string
              description: 'Create an alert for every unique value of the specified fields. For example, you can create a rule per host or every mount point of each host. IMPORTANT: If you include the same field in both the `filterQuery` and `groupBy`, you might receive fewer results than you expect. For example, if you filter by `cloud.region: us-east`, grouping by `cloud.region` will have no effect because the filter query can match only one region.'
            sourceId:
              type: string
          description: The parameters for the metric threshold rule. These parameters are appropriate when `rule_type_id` is `metrics.alert.threshold`.
        rule_type_id:
          enum:
            - metrics.alert.threshold
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_ml_anomaly_charts:
      required:
        - job_ids
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        job_ids:
          maxItems: 10000
          minItems: 1
          type: array
          items:
            maxLength: 1000
            minLength: 1
            type: string
          description: Anomaly detection job or group IDs whose results are shown in the charts.
        max_series_to_plot:
          maximum: 50
          minimum: 1
          type: number
          description: Maximum number of anomaly series to plot.
        severity_threshold:
          maxItems: 5
          type: array
          items:
            anyOf:
              - required:
                  - min
                  - max
                type: object
                properties:
                  max:
                    enum:
                      - 3
                    type: number
                  min:
                    enum:
                      - 0
                    type: number
                additionalProperties: false
              - required:
                  - min
                  - max
                type: object
                properties:
                  max:
                    enum:
                      - 25
                    type: number
                  min:
                    enum:
                      - 3
                    type: number
                additionalProperties: false
              - required:
                  - min
                  - max
                type: object
                properties:
                  max:
                    enum:
                      - 50
                    type: number
                  min:
                    enum:
                      - 25
                    type: number
                additionalProperties: false
              - required:
                  - min
                  - max
                type: object
                properties:
                  max:
                    enum:
                      - 75
                    type: number
                  min:
                    enum:
                      - 50
                    type: number
                additionalProperties: false
              - required:
                  - min
                type: object
                properties:
                  min:
                    enum:
                      - 75
                    type: number
                additionalProperties: false
          description: Severity threshold ranges used to filter anomaly results.
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: Anomaly Charts embeddable
    Kibana_HTTP_APIs_ml_anomaly_swimlane:
      anyOf:
        - required:
            - job_ids
            - swimlane_type
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            job_ids:
              maxItems: 10000
              minItems: 1
              type: array
              items:
                maxLength: 1000
                minLength: 1
                type: string
              description: IDs of the anomaly detection jobs or groups whose results are shown in the swim lane.
            per_page:
              minimum: 1
              type: number
              description: Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes.
            swimlane_type:
              enum:
                - overall
              type: string
            time_range:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
            title:
              type: string
              description: The panel title.
          additionalProperties: false
        - required:
            - job_ids
            - swimlane_type
            - view_by
          type: object
          properties:
            description:
              type: string
              description: A short description of the panel.
            hide_border:
              type: boolean
              description: 'When true, the panel border is hidden. Defaults to false.'
            hide_title:
              type: boolean
              description: 'When true, the panel title is hidden. Defaults to false.'
            job_ids:
              maxItems: 10000
              minItems: 1
              type: array
              items:
                maxLength: 1000
                minLength: 1
                type: string
              description: IDs of the anomaly detection jobs or groups whose results are shown in the swim lane.
            per_page:
              minimum: 1
              type: number
              description: Number of rows to display per page in a view-by swim lane. Ignored for overall swim lanes.
            swimlane_type:
              enum:
                - viewBy
              type: string
            time_range:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
            title:
              type: string
              description: The panel title.
            view_by:
              maxLength: 1000
              minLength: 1
              type: string
              description: Field name used to split anomalies into a view-by swim lane.
          additionalProperties: false
      description: Anomaly Swim Lane embeddable
    Kibana_HTTP_APIs_ml_single_metric_viewer:
      required:
        - job_ids
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        forecast_id:
          maxLength: 1000
          type: string
          description: Identifier of a forecast to overlay on the chart.
        function_description:
          maxLength: 1000
          type: string
          description: 'For detectors that use the `metric` function, selects which value to plot: `min`, `max`, or `mean`. Ignored for other detector functions. When omitted, the viewer derives a default from the highest-scoring anomaly record.'
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        job_ids:
          maxItems: 1
          minItems: 1
          type: array
          items:
            maxLength: 1000
            minLength: 1
            type: string
          description: Anomaly detection job ID whose results are shown in the single metric viewer.
        selected_detector_index:
          minimum: 0
          type: number
          description: Zero-based index of the detector (the Elasticsearch detector_index) within the job whose results are shown.
          default: 0
        selected_entities:
          type: object
          additionalProperties:
            anyOf:
              - maxLength: 10000
                type: string
              - type: number
          description: 'Values of the partition, by, or over fields that identify the single time series to display.'
        time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-es-query-server-timeRangeSchema'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: Single Metric Viewer embeddable
    Kibana_HTTP_APIs_monitoring-alert-cluster-health-create-rule-body-alerting:
      title: Cluster health
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Cluster Health Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the cluster health rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_cluster_health`.
        rule_type_id:
          enum:
            - monitoring_alert_cluster_health
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-cpu-usage-create-rule-body-alerting:
      title: CPU usage
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: CPU Usage Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the CPU usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_cpu_usage`.
        rule_type_id:
          enum:
            - monitoring_alert_cpu_usage
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-disk-usage-create-rule-body-alerting:
      title: Disk usage
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Disk Usage Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the disk usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_disk_usage`.
        rule_type_id:
          enum:
            - monitoring_alert_disk_usage
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-elasticsearch-version-mismatch-create-rule-body-alerting:
      title: Elasticsearch version mismatch
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: ES Version Mismatch Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the ES version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_elasticsearch_version_mismatch`.
        rule_type_id:
          enum:
            - monitoring_alert_elasticsearch_version_mismatch
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-jvm-memory-usage-create-rule-body-alerting:
      title: JVM memory usage
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Memory Usage Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the memory usage rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_jvm_memory_usage`.
        rule_type_id:
          enum:
            - monitoring_alert_jvm_memory_usage
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-kibana-version-mismatch-create-rule-body-alerting:
      title: Kibana version mismatch
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Kibana Version Mismatch Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the Kibana version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_kibana_version_mismatch`.
        rule_type_id:
          enum:
            - monitoring_alert_kibana_version_mismatch
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-license-expiration-create-rule-body-alerting:
      title: License expiration
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: License Expiration Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the license expiration rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_license_expiration`.
        rule_type_id:
          enum:
            - monitoring_alert_license_expiration
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-logstash-version-mismatch-create-rule-body-alerting:
      title: Logstash version mismatch
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Logstash Version Mismatch Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the logstash version mismatch rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_logstash_version_mismatch`.
        rule_type_id:
          enum:
            - monitoring_alert_logstash_version_mismatch
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-missing-monitoring-data-create-rule-body-alerting:
      title: Missing monitoring data
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Missing Monitoring Data Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the missing monitoring data rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_missing_monitoring_data`.
        rule_type_id:
          enum:
            - monitoring_alert_missing_monitoring_data
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-nodes-changed-create-rule-body-alerting:
      title: Nodes changed
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Nodes Changed Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the nodes changed rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_nodes_changed`.
        rule_type_id:
          enum:
            - monitoring_alert_nodes_changed
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-thread-pool-search-rejections-create-rule-body-alerting:
      title: Thread pool search rejections
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Thread Pool Search Rejections Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            threshold:
              type: number
          additionalProperties: false
          description: The parameters for the thread pool search rejections rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_thread_pool_search_rejections`.
        rule_type_id:
          enum:
            - monitoring_alert_thread_pool_search_rejections
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-alert-thread-pool-write-rejections-create-rule-body-alerting:
      title: Thread pool write rejections
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Thread Pool Write Rejections Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            threshold:
              type: number
          additionalProperties: false
          description: The parameters for the thread pool write rejections rule. These parameters are appropriate when `rule_type_id` is `monitoring_alert_thread_pool_write_rejections`.
        rule_type_id:
          enum:
            - monitoring_alert_thread_pool_write_rejections
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-ccr-read-exceptions-create-rule-body-alerting:
      title: CCR read exceptions
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: CCR Read Exceptions Rule Params
          required:
            - duration
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the CCR read exceptions rule. These parameters are appropriate when `rule_type_id` is `monitoring_ccr_read_exceptions`.
        rule_type_id:
          enum:
            - monitoring_ccr_read_exceptions
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_monitoring-shard-size-create-rule-body-alerting:
      title: Large shard size
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Large Shard Size Rule Params
          required:
            - duration
            - indexPattern
          type: object
          properties:
            duration:
              type: string
            filterQuery:
              type: string
            filterQueryText:
              type: string
            indexPattern:
              type: string
            limit:
              type: string
            threshold:
              type: number
          description: The parameters for the large shard size rule. These parameters are appropriate when `rule_type_id` is `monitoring_shard_size`.
        rule_type_id:
          enum:
            - monitoring_shard_size
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_mosaicLibItemNoESQL:
      title: Mosaic Chart (library)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_breakdown_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
          description: Array of group breakdown dimensions (minimum 1)
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                additionalProperties: false
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicLegend'
        metric:
          anyOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - mosaic
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_new_agent_policy:
      title: new_agent_policy
      required:
        - name
        - namespace
      type: object
      properties:
        advanced_settings:
          type: object
          properties:
            agent_download_target_directory: { }
            agent_download_timeout: { }
            agent_features_disable_policy_change_acks_enabled: { }
            agent_features_include_tags_in_events_enabled: { }
            agent_internal: { }
            agent_limits_go_max_procs: { }
            agent_logging_files_interval: { }
            agent_logging_files_keepfiles: { }
            agent_logging_files_rotateeverybytes: { }
            agent_logging_level: { }
            agent_logging_metrics_period: { }
            agent_logging_to_files: { }
            agent_monitoring_runtime_experimental: { }
          additionalProperties: false
        agent_features:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - enabled
            type: object
            properties:
              enabled:
                type: boolean
              name:
                type: string
            additionalProperties: false
        agentless:
          type: object
          properties:
            cloud_connectors:
              required:
                - enabled
              type: object
              properties:
                enabled:
                  type: boolean
                target_csp:
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
              additionalProperties: false
            cluster_id:
              type: string
            resources:
              type: object
              properties:
                requests:
                  type: object
                  properties:
                    cpu:
                      type: string
                    memory:
                      type: string
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        data_output_id:
          type:
            - 'null'
            - string
        description:
          type: string
        download_source_id:
          type:
            - 'null'
            - string
          description: Use `download_source_ids` instead
          deprecated: true
        download_source_ids:
          maxItems: 3
          type: array
          items:
            maxLength: 500
            type: string
            description: 'A download source ID, or the reserved value ''default'' to dynamically reference whichever source is currently set as default.'
        fleet_server_host_id:
          type:
            - 'null'
            - string
        force:
          type: boolean
        global_data_tags:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
              value:
                type:
                  - number
                  - string
            additionalProperties: false
          description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
        has_agent_version_conditions:
          type: boolean
        has_fleet_server:
          type: boolean
        id:
          type: string
        inactivity_timeout:
          minimum: 0
          type: number
          default: 1209600
        is_default:
          type: boolean
        is_default_fleet_server:
          type: boolean
        is_managed:
          type: boolean
        is_protected:
          type: boolean
        is_verifier:
          type: boolean
        keep_monitoring_alive:
          type:
            - 'null'
            - boolean
          description: 'When set to true, monitoring will be enabled but logs/metrics collection will be disabled'
        min_agent_version:
          type:
            - 'null'
            - string
        monitoring_diagnostics:
          type: object
          properties:
            limit:
              type: object
              properties:
                burst:
                  type: number
                interval:
                  type: string
              additionalProperties: false
            uploader:
              type: object
              properties:
                init_dur:
                  type: string
                max_dur:
                  type: string
                max_retries:
                  type: number
              additionalProperties: false
          additionalProperties: false
        monitoring_enabled:
          maxItems: 3
          type: array
          items:
            enum:
              - logs
              - metrics
              - traces
            type: string
        monitoring_http:
          type: object
          properties:
            buffer:
              type: object
              properties:
                enabled:
                  type: boolean
                  default: false
              additionalProperties: false
            enabled:
              type: boolean
            host:
              type: string
            port:
              maximum: 65353
              minimum: 0
              type: number
          additionalProperties: false
        monitoring_output_id:
          type:
            - 'null'
            - string
        monitoring_pprof_enabled:
          type: boolean
        name:
          minLength: 1
          type: string
        namespace:
          minLength: 1
          type: string
        overrides:
          type:
            - 'null'
            - object
          additionalProperties: { }
          description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
        package_agent_version_conditions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - title
              - version_condition
            type: object
            properties:
              name:
                type: string
              title:
                type: string
              version_condition:
                type: string
            additionalProperties: false
        required_versions:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - version
              - percentage
            type: object
            properties:
              percentage:
                maximum: 100
                minimum: 0
                type: number
                description: Target percentage of agents to auto upgrade
              version:
                type: string
                description: Target version for automatic agent upgrade
            additionalProperties: false
        space_ids:
          maxItems: 100
          type: array
          items:
            type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the agent policy supports agentless integrations. Deprecated in favor of the Fleet managed integrations API.
          deprecated: true
        unenroll_timeout:
          minimum: 0
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_new_connector:
      title: new_connector
      required:
        - name
        - connector_type_id
      type: object
      properties:
        connector_type_id:
          type: string
          description: The type of connector.
        name:
          type: string
          description: The display name for the connector.
        config:
          oneOf:
            - $ref: '#/components/schemas/bedrock_config'
            - $ref: '#/components/schemas/crowdstrike_config'
            - $ref: '#/components/schemas/d3security_config'
            - $ref: '#/components/schemas/email_config'
            - $ref: '#/components/schemas/gemini_config'
            - $ref: '#/components/schemas/resilient_config'
            - $ref: '#/components/schemas/index_config'
            - $ref: '#/components/schemas/jira_config'
            - $ref: '#/components/schemas/genai_azure_config'
            - $ref: '#/components/schemas/genai_openai_config'
            - $ref: '#/components/schemas/genai_openai_other_config'
            - $ref: '#/components/schemas/opsgenie_config'
            - $ref: '#/components/schemas/pagerduty_config'
            - $ref: '#/components/schemas/sentinelone_config'
            - $ref: '#/components/schemas/servicenow_config'
            - $ref: '#/components/schemas/servicenow_itom_config'
            - $ref: '#/components/schemas/slack_api_config'
            - $ref: '#/components/schemas/swimlane_config'
            - $ref: '#/components/schemas/thehive_config'
            - $ref: '#/components/schemas/tines_config'
            - $ref: '#/components/schemas/torq_config'
            - $ref: '#/components/schemas/webhook_config'
            - $ref: '#/components/schemas/cases_webhook_config'
            - $ref: '#/components/schemas/xmatters_config'
          additionalProperties: { }
          description: The connector configuration details.
        secrets:
          oneOf:
            - $ref: '#/components/schemas/bedrock_secrets'
            - $ref: '#/components/schemas/crowdstrike_secrets'
            - $ref: '#/components/schemas/d3security_secrets'
            - $ref: '#/components/schemas/email_secrets'
            - $ref: '#/components/schemas/gemini_secrets'
            - $ref: '#/components/schemas/resilient_secrets'
            - $ref: '#/components/schemas/jira_secrets'
            - $ref: '#/components/schemas/defender_secrets'
            - $ref: '#/components/schemas/teams_secrets'
            - $ref: '#/components/schemas/genai_secrets'
            - $ref: '#/components/schemas/opsgenie_secrets'
            - $ref: '#/components/schemas/pagerduty_secrets'
            - $ref: '#/components/schemas/sentinelone_secrets'
            - $ref: '#/components/schemas/servicenow_secrets'
            - $ref: '#/components/schemas/slack_api_secrets'
            - $ref: '#/components/schemas/swimlane_secrets'
            - $ref: '#/components/schemas/thehive_secrets'
            - $ref: '#/components/schemas/tines_secrets'
            - $ref: '#/components/schemas/torq_secrets'
            - $ref: '#/components/schemas/webhook_secrets'
            - $ref: '#/components/schemas/cases_webhook_secrets'
            - $ref: '#/components/schemas/xmatters_secrets'
          additionalProperties: { }
      additionalProperties: false
    Kibana_HTTP_APIs_new_enrollment_api_key:
      title: new_enrollment_api_key
      required:
        - policy_id
      type: object
      properties:
        expiration:
          maxLength: 20
          type: string
          description: 'The expiration time for the enrollment token, expressed as a duration (for example, 30d, 24h, 90m). By default, enrollment tokens never expire.'
        name:
          type: string
        policy_id:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_new_maintenance_window:
      title: new_maintenance_window
      required:
        - title
        - schedule
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
        schedule:
          required:
            - custom
          type: object
          properties:
            custom:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_request'
          additionalProperties: false
        scope:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_scope'
        title:
          type: string
          description: 'The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.'
      additionalProperties: false
    Kibana_HTTP_APIs_new_output_elasticsearch:
      title: new_output_elasticsearch
      required:
        - name
        - type
        - hosts
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            format: uri
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        preset:
          enum:
            - balanced
            - custom
            - throughput
            - scale
            - latency
          type: string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        type:
          enum:
            - elasticsearch
          type: string
        write_to_logs_streams:
          type:
            - 'null'
            - boolean
      additionalProperties: false
    Kibana_HTTP_APIs_new_output_kafka:
      title: new_output_kafka
      required:
        - name
        - type
        - hosts
        - auth_type
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        auth_type:
          enum:
            - none
            - user_pass
            - ssl
            - kerberos
          type: string
        broker_timeout:
          type: number
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        client_id:
          type: string
        compression:
          enum:
            - gzip
            - snappy
            - lz4
            - none
          type: string
        compression_level:
          type:
            - 'null'
            - number
        config_yaml:
          type:
            - 'null'
            - string
        connection_type:
          enum:
            - plaintext
            - encryption
          type: string
        hash:
          type: object
          properties:
            hash:
              type: string
            random:
              type: boolean
          additionalProperties: false
        headers:
          maxItems: 100
          type: array
          items:
            required:
              - key
              - value
            type: object
            properties:
              key:
                type: string
              value:
                type: string
            additionalProperties: false
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        key:
          type: string
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        partition:
          enum:
            - random
            - round_robin
            - hash
          type: string
        password:
          type:
            - 'null'
            - string
        proxy_id:
          type:
            - 'null'
            - string
          description: Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.
          deprecated: true
        random:
          type: object
          properties:
            group_events:
              type: number
          additionalProperties: false
        required_acks:
          enum:
            - 1
            - 0
            - -1
          type: integer
        round_robin:
          type: object
          properties:
            group_events:
              type: number
          additionalProperties: false
        sasl:
          type:
            - 'null'
            - object
          properties:
            mechanism:
              enum:
                - PLAIN
                - SCRAM-SHA-256
                - SCRAM-SHA-512
              type: string
          additionalProperties: false
        secrets:
          type: object
          properties:
            password:
              anyOf:
                - required:
                    - id
                  type: object
                  properties:
                    hash:
                      type: string
                    id:
                      type: string
                  additionalProperties: false
                - type: string
            ssl:
              required:
                - key
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        timeout:
          type: number
        topic:
          type: string
        type:
          enum:
            - kafka
          type: string
        username:
          type:
            - 'null'
            - string
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_new_output_logstash:
      title: new_output_logstash
      required:
        - name
        - type
        - hosts
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        type:
          enum:
            - logstash
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_new_output_otlp:
      title: new_output_otlp
      required:
        - name
        - type
        - otlp_exporter
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otlp_exporter:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter'
          discriminator:
            propertyName: protocol
            mapping:
              grpc: '#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter'
              http/protobuf: '#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter'
        secrets:
          type: object
          properties:
            otlp_exporter:
              type: object
              properties:
                tls:
                  type: object
                  properties:
                    key_pem:
                      anyOf:
                        - required:
                            - id
                          type: object
                          properties:
                            hash:
                              type: string
                            id:
                              type: string
                          additionalProperties: false
                        - type: string
                    tpm:
                      type: object
                      properties:
                        auth:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                hash:
                                  type: string
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        owner_auth:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                hash:
                                  type: string
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        type:
          enum:
            - otlp
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_new_output_remote_elasticsearch:
      title: new_output_remote_elasticsearch
      required:
        - name
        - type
        - hosts
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            format: uri
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        kibana_api_key:
          type:
            - 'null'
            - string
        kibana_url:
          type:
            - 'null'
            - string
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        preset:
          enum:
            - balanced
            - custom
            - throughput
            - scale
            - latency
          type: string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            service_token:
              anyOf:
                - required:
                    - id
                  type: object
                  properties:
                    hash:
                      type: string
                    id:
                      type: string
                  additionalProperties: false
                - type: string
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        service_token:
          type:
            - 'null'
            - string
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        sync_integrations:
          type: boolean
        sync_uninstalled_integrations:
          type: boolean
        type:
          enum:
            - remote_elasticsearch
          type: string
        write_to_logs_streams:
          type:
            - 'null'
            - boolean
      additionalProperties: false
    Kibana_HTTP_APIs_new_rule:
      title: new_rule
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          type: object
          additionalProperties: { }
          description: The parameters for the rule.
        rule_type_id:
          type: string
          description: The rule type identifier.
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_new_rule_action:
      title: new_rule_action
      required:
        - id
      type: object
      properties:
        alerts_filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action_alerts_filter'
        frequency:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action_frequency'
        group:
          type: string
          description: 'The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don''t need to group actions, set to `default`.'
        id:
          type: string
          description: The identifier for the connector saved object.
        params:
          type: object
          additionalProperties: { }
          description: 'The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.'
        use_alert_data_for_template:
          type: boolean
          description: Indicates whether to use alert data as a template.
        uuid:
          type: string
          description: A universally unique identifier (UUID) for the action.
      additionalProperties: false
      description: An action that runs under defined conditions.
    Kibana_HTTP_APIs_new_rule_action_alerts_filter:
      title: new_rule_action_alerts_filter
      type: object
      properties:
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerts_filter_query'
        timeframe:
          required:
            - days
            - hours
            - timezone
          type: object
          properties:
            days:
              type: array
              items:
                enum:
                  - 1
                  - 2
                  - 3
                  - 4
                  - 5
                  - 6
                  - 7
                type: integer
              description: 'Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.'
            hours:
              required:
                - start
                - end
              type: object
              properties:
                end:
                  type: string
                  description: 'The end of the time frame, in 24-hour notation (`hh:mm`).'
                start:
                  type: string
                  description: 'The start of the time frame, in 24-hour notation (`hh:mm`).'
              additionalProperties: false
              description: 'Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day.'
            timezone:
              type: string
              description: The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended.
          additionalProperties: false
          description: Defines a period that limits whether the action runs.
      additionalProperties: false
      description: 'Conditions that affect whether the action runs. If you specify multiple conditions, all conditions must be met for the action to run. For example, if an alert occurs within the specified time frame and matches the query, the action runs.'
    Kibana_HTTP_APIs_new_rule_action_frequency:
      title: new_rule_action_frequency
      required:
        - summary
        - notify_when
      type: object
      properties:
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
          type: string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        summary:
          type: boolean
          description: Indicates whether the action is a summary.
        throttle:
          type:
            - 'null'
            - string
          description: 'The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when `notify_when` is set to `onThrottleInterval`. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
          default: 'null'
      additionalProperties: false
    Kibana_HTTP_APIs_observability-rules-custom-threshold-create-rule-body-alerting:
      title: Custom threshold
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Custom Threshold Rule Params
          required:
            - criteria
            - searchConfiguration
          type: object
          properties:
            alertOnGroupDisappear:
              type: boolean
            alertOnNoData:
              type: boolean
            criteria:
              type: array
              items:
                required:
                  - threshold
                  - comparator
                  - timeUnit
                  - timeSize
                  - metrics
                type: object
                properties:
                  aggType:
                    enum:
                      - custom
                    type: string
                  comparator:
                    type: string
                  equation:
                    type: string
                  label:
                    type: string
                  metrics:
                    type: array
                    items:
                      anyOf:
                        - required:
                            - name
                            - aggType
                            - field
                          type: object
                          properties:
                            aggType:
                              type: string
                            field:
                              type: string
                            filter:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                        - required:
                            - name
                            - aggType
                          type: object
                          properties:
                            aggType:
                              enum:
                                - count
                              type: string
                            filter:
                              type: string
                            name:
                              type: string
                          additionalProperties: false
                  threshold:
                    type: array
                    items:
                      type: number
                  timeSize:
                    type: number
                  timeUnit:
                    type: string
                  warningComparator:
                    type: string
                  warningThreshold:
                    maxItems: 2
                    type: array
                    items:
                      type: number
                      description: 'The threshold value that is used with the `warningComparator`. If the `warningComparator` is `between`, you must specify the boundary values.'
                additionalProperties: false
            groupBy:
              anyOf:
                - type: string
                - type: array
                  items:
                    type: string
            noDataBehavior:
              enum:
                - recover
                - remainActive
                - alertOnNoData
              type: string
            searchConfiguration:
              required:
                - index
                - query
              type: object
              properties:
                filter:
                  type: array
                  items:
                    required:
                      - meta
                    type: object
                    properties:
                      meta:
                        type: object
                        additionalProperties: { }
                      query:
                        type: object
                        additionalProperties: { }
                    additionalProperties: false
                index:
                  anyOf:
                    - type: string
                    - required:
                        - title
                      type: object
                      properties:
                        allowHidden:
                          type: boolean
                        allowNoIndex:
                          type: boolean
                        fieldAttrs:
                          type: object
                          additionalProperties:
                            type: object
                            properties:
                              count:
                                type: number
                              customDescription:
                                maxLength: 300
                                type: string
                              customLabel:
                                type: string
                            additionalProperties: false
                        fieldFormats:
                          type: object
                          additionalProperties:
                            required:
                              - params
                            type: object
                            properties:
                              id:
                                type: string
                              params: { }
                            additionalProperties: false
                        fields:
                          type: object
                          additionalProperties:
                            required:
                              - name
                            type: object
                            properties:
                              aggregatable:
                                type: boolean
                              count:
                                minimum: 0
                                type: number
                              customDescription:
                                maxLength: 300
                                type: string
                              customLabel:
                                type: string
                              esTypes:
                                type: array
                                items:
                                  type: string
                              format:
                                required:
                                  - params
                                type: object
                                properties:
                                  id:
                                    type: string
                                  params: { }
                                additionalProperties: false
                              name:
                                maxLength: 1000
                                type: string
                              readFromDocValues:
                                type: boolean
                              runtimeField:
                                anyOf:
                                  - required:
                                      - type
                                    type: object
                                    properties:
                                      customDescription:
                                        maxLength: 300
                                        type: string
                                      customLabel:
                                        type: string
                                      format:
                                        required:
                                          - params
                                        type: object
                                        properties:
                                          id:
                                            type: string
                                          params: { }
                                        additionalProperties: false
                                      popularity:
                                        minimum: 0
                                        type: number
                                      script:
                                        required:
                                          - source
                                        type: object
                                        properties:
                                          source:
                                            type: string
                                        additionalProperties: false
                                      type:
                                        enum:
                                          - keyword
                                          - long
                                          - double
                                          - date
                                          - ip
                                          - boolean
                                          - geo_point
                                        type: string
                                    additionalProperties: false
                                  - required:
                                      - type
                                    type: object
                                    properties:
                                      fields:
                                        type: object
                                        additionalProperties:
                                          required:
                                            - type
                                          type: object
                                          properties:
                                            customDescription:
                                              maxLength: 300
                                              type: string
                                            customLabel:
                                              type: string
                                            format:
                                              required:
                                                - params
                                              type: object
                                              properties:
                                                id:
                                                  type: string
                                                params: { }
                                              additionalProperties: false
                                            popularity:
                                              minimum: 0
                                              type: number
                                            type:
                                              enum:
                                                - keyword
                                                - long
                                                - double
                                                - date
                                                - ip
                                                - boolean
                                                - geo_point
                                              type: string
                                          additionalProperties: false
                                      script:
                                        required:
                                          - source
                                        type: object
                                        properties:
                                          source:
                                            type: string
                                        additionalProperties: false
                                      type:
                                        enum:
                                          - composite
                                        type: string
                                    additionalProperties: false
                              script:
                                maxLength: 1000000
                                type: string
                              scripted:
                                type: boolean
                              searchable:
                                type: boolean
                              shortDotsEnable:
                                type: boolean
                              subType:
                                type: object
                                properties:
                                  multi:
                                    required:
                                      - parent
                                    type: object
                                    properties:
                                      parent:
                                        type: string
                                    additionalProperties: false
                                  nested:
                                    required:
                                      - path
                                    type: object
                                    properties:
                                      path:
                                        type: string
                                    additionalProperties: false
                                additionalProperties: false
                              type:
                                maxLength: 1000
                                type: string
                                default: string
                            additionalProperties: false
                        id:
                          type: string
                        managed:
                          type: boolean
                        name:
                          type: string
                        namespaces:
                          type: array
                          items:
                            type: string
                        runtimeFieldMap:
                          type: object
                          additionalProperties:
                            anyOf:
                              - required:
                                  - type
                                type: object
                                properties:
                                  customDescription:
                                    maxLength: 300
                                    type: string
                                  customLabel:
                                    type: string
                                  format:
                                    required:
                                      - params
                                    type: object
                                    properties:
                                      id:
                                        type: string
                                      params: { }
                                    additionalProperties: false
                                  popularity:
                                    minimum: 0
                                    type: number
                                  script:
                                    required:
                                      - source
                                    type: object
                                    properties:
                                      source:
                                        type: string
                                    additionalProperties: false
                                  type:
                                    enum:
                                      - keyword
                                      - long
                                      - double
                                      - date
                                      - ip
                                      - boolean
                                      - geo_point
                                    type: string
                                additionalProperties: false
                              - required:
                                  - type
                                type: object
                                properties:
                                  fields:
                                    type: object
                                    additionalProperties:
                                      required:
                                        - type
                                      type: object
                                      properties:
                                        customDescription:
                                          maxLength: 300
                                          type: string
                                        customLabel:
                                          type: string
                                        format:
                                          required:
                                            - params
                                          type: object
                                          properties:
                                            id:
                                              type: string
                                            params: { }
                                          additionalProperties: false
                                        popularity:
                                          minimum: 0
                                          type: number
                                        type:
                                          enum:
                                            - keyword
                                            - long
                                            - double
                                            - date
                                            - ip
                                            - boolean
                                            - geo_point
                                          type: string
                                      additionalProperties: false
                                  script:
                                    required:
                                      - source
                                    type: object
                                    properties:
                                      source:
                                        type: string
                                    additionalProperties: false
                                  type:
                                    enum:
                                      - composite
                                    type: string
                                additionalProperties: false
                        sourceFilters:
                          type: array
                          items:
                            required:
                              - value
                            type: object
                            properties:
                              clientId:
                                type:
                                  - number
                                  - string
                              value:
                                type: string
                            additionalProperties: false
                        timeFieldName:
                          type: string
                        title:
                          type: string
                        type:
                          type: string
                        typeMeta:
                          type: object
                        version:
                          type: string
                      additionalProperties: false
                query:
                  required:
                    - language
                    - query
                  type: object
                  properties:
                    language:
                      type: string
                    query:
                      type: string
                  additionalProperties: false
              additionalProperties: false
          description: The parameters for the custom threshold rule. These parameters are appropriate when `rule_type_id` is `observability.rules.custom_threshold`.
        rule_type_id:
          enum:
            - observability.rules.custom_threshold
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_otlp_grpc_exporter:
      title: otlp_grpc_exporter
      required:
        - endpoint
        - protocol
      type: object
      properties:
        authority:
          maxLength: 256
          type:
            - 'null'
            - string
        balancer_name:
          maxLength: 256
          type:
            - 'null'
            - string
        compression:
          enum:
            - gzip
            - snappy
            - zstd
            - none
          type: string
        endpoint:
          maxLength: 2048
          type: string
        headers:
          type:
            - 'null'
            - object
          additionalProperties:
            maxLength: 1000
            type: string
        keepalive:
          type:
            - 'null'
            - object
          properties:
            permit_without_stream:
              type: boolean
            time:
              maxLength: 64
              type:
                - 'null'
                - string
            timeout:
              maxLength: 64
              type:
                - 'null'
                - string
          additionalProperties: false
        protocol:
          enum:
            - grpc
          type: string
        read_buffer_size:
          type:
            - 'null'
            - number
        retry_on_failure:
          type:
            - 'null'
            - object
          properties:
            enabled:
              type: boolean
            initial_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            max_elapsed_time:
              maxLength: 64
              type:
                - 'null'
                - string
            max_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            multiplier:
              type:
                - 'null'
                - number
            randomization_factor:
              type:
                - 'null'
                - number
          additionalProperties: false
        sending_queue:
          type:
            - 'null'
            - object
          properties:
            batch:
              type:
                - 'null'
                - object
              properties:
                flush_timeout:
                  maxLength: 64
                  type:
                    - 'null'
                    - string
                max_size:
                  type:
                    - 'null'
                    - number
                min_size:
                  type:
                    - 'null'
                    - number
                partition:
                  type:
                    - 'null'
                    - object
                  properties:
                    metadata_keys:
                      maxItems: 100
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 256
                        type: string
                  additionalProperties: false
                sizer:
                  enum:
                    - items
                    - bytes
                  type: string
              additionalProperties: false
            block_on_overflow:
              type: boolean
            enabled:
              type: boolean
            num_consumers:
              type:
                - 'null'
                - number
            queue_size:
              type:
                - 'null'
                - number
            sizer:
              enum:
                - requests
                - items
                - bytes
              type: string
            wait_for_result:
              type: boolean
          additionalProperties: false
        timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        tls:
          type:
            - 'null'
            - object
          properties:
            ca_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            ca_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cert_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            cert_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cipher_suites:
              maxItems: 100
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                type: string
            curve_preferences:
              maxItems: 4
              type:
                - 'null'
                - array
              items:
                enum:
                  - X25519
                  - P521
                  - P256
                  - P384
                type: string
            include_insecure_cipher_suites:
              type: boolean
            include_system_ca_certs_pool:
              type: boolean
            insecure:
              type: boolean
            insecure_skip_verify:
              type: boolean
            key_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            max_version:
              maxLength: 10
              type:
                - 'null'
                - string
            min_version:
              maxLength: 10
              type:
                - 'null'
                - string
            reload_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            server_name_override:
              maxLength: 256
              type:
                - 'null'
                - string
            tpm:
              type:
                - 'null'
                - object
              properties:
                enabled:
                  type: boolean
                path:
                  maxLength: 4096
                  type:
                    - 'null'
                    - string
              additionalProperties: false
          additionalProperties: false
        user_agent:
          maxLength: 256
          type:
            - 'null'
            - string
        wait_for_ready:
          type: boolean
        write_buffer_size:
          type:
            - 'null'
            - number
      additionalProperties: false
    Kibana_HTTP_APIs_otlp_http_exporter:
      title: otlp_http_exporter
      required:
        - endpoint
        - protocol
      type: object
      properties:
        compression:
          enum:
            - gzip
            - none
          type: string
        compression_params:
          type:
            - 'null'
            - object
          properties:
            level:
              type: number
          additionalProperties: false
        cookies:
          type:
            - 'null'
            - object
          properties:
            enabled:
              type: boolean
          additionalProperties: false
        disable_keep_alives:
          type: boolean
        encoding:
          enum:
            - proto
            - json
          type: string
        endpoint:
          maxLength: 2048
          type: string
        force_attempt_http2:
          type: boolean
        headers:
          type:
            - 'null'
            - object
          additionalProperties:
            maxLength: 1000
            type: string
        http2_ping_timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        http2_read_idle_timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        idle_conn_timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        logs_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        max_conns_per_host:
          type:
            - 'null'
            - number
        max_idle_conns:
          type:
            - 'null'
            - number
        max_idle_conns_per_host:
          type:
            - 'null'
            - number
        metrics_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        profiles_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        protocol:
          enum:
            - http/protobuf
          type: string
        proxy_url:
          maxLength: 2048
          type:
            - 'null'
            - string
        read_buffer_size:
          type:
            - 'null'
            - number
        retry_on_failure:
          type:
            - 'null'
            - object
          properties:
            enabled:
              type: boolean
            initial_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            max_elapsed_time:
              maxLength: 64
              type:
                - 'null'
                - string
            max_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            multiplier:
              type:
                - 'null'
                - number
            randomization_factor:
              type:
                - 'null'
                - number
          additionalProperties: false
        sending_queue:
          type:
            - 'null'
            - object
          properties:
            batch:
              type:
                - 'null'
                - object
              properties:
                flush_timeout:
                  maxLength: 64
                  type:
                    - 'null'
                    - string
                max_size:
                  type:
                    - 'null'
                    - number
                min_size:
                  type:
                    - 'null'
                    - number
                partition:
                  type:
                    - 'null'
                    - object
                  properties:
                    metadata_keys:
                      maxItems: 100
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 256
                        type: string
                  additionalProperties: false
                sizer:
                  enum:
                    - items
                    - bytes
                  type: string
              additionalProperties: false
            block_on_overflow:
              type: boolean
            enabled:
              type: boolean
            num_consumers:
              type:
                - 'null'
                - number
            queue_size:
              type:
                - 'null'
                - number
            sizer:
              enum:
                - requests
                - items
                - bytes
              type: string
            wait_for_result:
              type: boolean
          additionalProperties: false
        timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        tls:
          type:
            - 'null'
            - object
          properties:
            ca_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            ca_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cert_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            cert_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cipher_suites:
              maxItems: 100
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                type: string
            curve_preferences:
              maxItems: 4
              type:
                - 'null'
                - array
              items:
                enum:
                  - X25519
                  - P521
                  - P256
                  - P384
                type: string
            include_insecure_cipher_suites:
              type: boolean
            include_system_ca_certs_pool:
              type: boolean
            insecure:
              type: boolean
            insecure_skip_verify:
              type: boolean
            key_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            max_version:
              maxLength: 10
              type:
                - 'null'
                - string
            min_version:
              maxLength: 10
              type:
                - 'null'
                - string
            reload_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            server_name_override:
              maxLength: 256
              type:
                - 'null'
                - string
            tpm:
              type:
                - 'null'
                - object
              properties:
                enabled:
                  type: boolean
                path:
                  maxLength: 4096
                  type:
                    - 'null'
                    - string
              additionalProperties: false
          additionalProperties: false
        traces_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        write_buffer_size:
          type:
            - 'null'
            - number
      additionalProperties: false
    Kibana_HTTP_APIs_otlp_response_grpc_exporter:
      title: otlp_response_grpc_exporter
      required:
        - endpoint
        - protocol
      type: object
      properties:
        authority:
          maxLength: 256
          type:
            - 'null'
            - string
        balancer_name:
          maxLength: 256
          type:
            - 'null'
            - string
        compression:
          enum:
            - gzip
            - snappy
            - zstd
            - none
          type: string
        endpoint:
          maxLength: 2048
          type: string
        headers:
          type:
            - 'null'
            - object
          additionalProperties:
            maxLength: 1000
            type: string
        keepalive:
          type:
            - 'null'
            - object
          properties:
            permit_without_stream:
              type: boolean
            time:
              maxLength: 64
              type:
                - 'null'
                - string
            timeout:
              maxLength: 64
              type:
                - 'null'
                - string
        protocol:
          enum:
            - grpc
          type: string
        read_buffer_size:
          type:
            - 'null'
            - number
        retry_on_failure:
          type:
            - 'null'
            - object
          properties:
            enabled:
              type: boolean
            initial_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            max_elapsed_time:
              maxLength: 64
              type:
                - 'null'
                - string
            max_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            multiplier:
              type:
                - 'null'
                - number
            randomization_factor:
              type:
                - 'null'
                - number
        sending_queue:
          type:
            - 'null'
            - object
          properties:
            batch:
              type:
                - 'null'
                - object
              properties:
                flush_timeout:
                  maxLength: 64
                  type:
                    - 'null'
                    - string
                max_size:
                  type:
                    - 'null'
                    - number
                min_size:
                  type:
                    - 'null'
                    - number
                partition:
                  type:
                    - 'null'
                    - object
                  properties:
                    metadata_keys:
                      maxItems: 100
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 256
                        type: string
                sizer:
                  enum:
                    - items
                    - bytes
                  type: string
            block_on_overflow:
              type: boolean
            enabled:
              type: boolean
            num_consumers:
              type:
                - 'null'
                - number
            queue_size:
              type:
                - 'null'
                - number
            sizer:
              enum:
                - requests
                - items
                - bytes
              type: string
            wait_for_result:
              type: boolean
        timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        tls:
          type:
            - 'null'
            - object
          properties:
            ca_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            ca_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cert_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            cert_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cipher_suites:
              maxItems: 100
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                type: string
            curve_preferences:
              maxItems: 4
              type:
                - 'null'
                - array
              items:
                enum:
                  - X25519
                  - P521
                  - P256
                  - P384
                type: string
            include_insecure_cipher_suites:
              type: boolean
            include_system_ca_certs_pool:
              type: boolean
            insecure:
              type: boolean
            insecure_skip_verify:
              type: boolean
            key_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            max_version:
              maxLength: 10
              type:
                - 'null'
                - string
            min_version:
              maxLength: 10
              type:
                - 'null'
                - string
            reload_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            server_name_override:
              maxLength: 256
              type:
                - 'null'
                - string
            tpm:
              type:
                - 'null'
                - object
              properties:
                enabled:
                  type: boolean
                path:
                  maxLength: 4096
                  type:
                    - 'null'
                    - string
        user_agent:
          maxLength: 256
          type:
            - 'null'
            - string
        wait_for_ready:
          type: boolean
        write_buffer_size:
          type:
            - 'null'
            - number
    Kibana_HTTP_APIs_otlp_response_http_exporter:
      title: otlp_response_http_exporter
      required:
        - endpoint
        - protocol
      type: object
      properties:
        compression:
          enum:
            - gzip
            - none
          type: string
        compression_params:
          type:
            - 'null'
            - object
          properties:
            level:
              type: number
        cookies:
          type:
            - 'null'
            - object
          properties:
            enabled:
              type: boolean
        disable_keep_alives:
          type: boolean
        encoding:
          enum:
            - proto
            - json
          type: string
        endpoint:
          maxLength: 2048
          type: string
        force_attempt_http2:
          type: boolean
        headers:
          type:
            - 'null'
            - object
          additionalProperties:
            maxLength: 1000
            type: string
        http2_ping_timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        http2_read_idle_timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        idle_conn_timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        logs_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        max_conns_per_host:
          type:
            - 'null'
            - number
        max_idle_conns:
          type:
            - 'null'
            - number
        max_idle_conns_per_host:
          type:
            - 'null'
            - number
        metrics_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        profiles_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        protocol:
          enum:
            - http/protobuf
          type: string
        proxy_url:
          maxLength: 2048
          type:
            - 'null'
            - string
        read_buffer_size:
          type:
            - 'null'
            - number
        retry_on_failure:
          type:
            - 'null'
            - object
          properties:
            enabled:
              type: boolean
            initial_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            max_elapsed_time:
              maxLength: 64
              type:
                - 'null'
                - string
            max_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            multiplier:
              type:
                - 'null'
                - number
            randomization_factor:
              type:
                - 'null'
                - number
        sending_queue:
          type:
            - 'null'
            - object
          properties:
            batch:
              type:
                - 'null'
                - object
              properties:
                flush_timeout:
                  maxLength: 64
                  type:
                    - 'null'
                    - string
                max_size:
                  type:
                    - 'null'
                    - number
                min_size:
                  type:
                    - 'null'
                    - number
                partition:
                  type:
                    - 'null'
                    - object
                  properties:
                    metadata_keys:
                      maxItems: 100
                      type:
                        - 'null'
                        - array
                      items:
                        maxLength: 256
                        type: string
                sizer:
                  enum:
                    - items
                    - bytes
                  type: string
            block_on_overflow:
              type: boolean
            enabled:
              type: boolean
            num_consumers:
              type:
                - 'null'
                - number
            queue_size:
              type:
                - 'null'
                - number
            sizer:
              enum:
                - requests
                - items
                - bytes
              type: string
            wait_for_result:
              type: boolean
        timeout:
          maxLength: 64
          type:
            - 'null'
            - string
        tls:
          type:
            - 'null'
            - object
          properties:
            ca_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            ca_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cert_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            cert_pem:
              maxLength: 65536
              type:
                - 'null'
                - string
            cipher_suites:
              maxItems: 100
              type:
                - 'null'
                - array
              items:
                maxLength: 256
                type: string
            curve_preferences:
              maxItems: 4
              type:
                - 'null'
                - array
              items:
                enum:
                  - X25519
                  - P521
                  - P256
                  - P384
                type: string
            include_insecure_cipher_suites:
              type: boolean
            include_system_ca_certs_pool:
              type: boolean
            insecure:
              type: boolean
            insecure_skip_verify:
              type: boolean
            key_file:
              maxLength: 4096
              type:
                - 'null'
                - string
            max_version:
              maxLength: 10
              type:
                - 'null'
                - string
            min_version:
              maxLength: 10
              type:
                - 'null'
                - string
            reload_interval:
              maxLength: 64
              type:
                - 'null'
                - string
            server_name_override:
              maxLength: 256
              type:
                - 'null'
                - string
            tpm:
              type:
                - 'null'
                - object
              properties:
                enabled:
                  type: boolean
                path:
                  maxLength: 4096
                  type:
                    - 'null'
                    - string
        traces_endpoint:
          maxLength: 2048
          type:
            - 'null'
            - string
        write_buffer_size:
          type:
            - 'null'
            - number
    Kibana_HTTP_APIs_output_response_elasticsearch:
      title: output_response_elasticsearch
      required:
        - name
        - type
        - hosts
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            format: uri
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        preset:
          enum:
            - balanced
            - custom
            - throughput
            - scale
            - latency
          type: string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                    - type: string
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_ssl'
        type:
          enum:
            - elasticsearch
          type: string
        write_to_logs_streams:
          type:
            - 'null'
            - boolean
    Kibana_HTTP_APIs_output_response_kafka:
      title: output_response_kafka
      required:
        - name
        - type
        - hosts
        - auth_type
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        auth_type:
          enum:
            - none
            - user_pass
            - ssl
            - kerberos
          type: string
        broker_timeout:
          type: number
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        client_id:
          type: string
        compression:
          enum:
            - gzip
            - snappy
            - lz4
            - none
          type: string
        compression_level:
          type:
            - 'null'
            - number
        config_yaml:
          type:
            - 'null'
            - string
        connection_type:
          enum:
            - plaintext
            - encryption
          type: string
        hash:
          type: object
          properties:
            hash:
              type: string
            random:
              type: boolean
        headers:
          maxItems: 100
          type: array
          items:
            required:
              - key
              - value
            type: object
            properties:
              key:
                type: string
              value:
                type: string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        key:
          type: string
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        partition:
          enum:
            - random
            - round_robin
            - hash
          type: string
        password:
          type:
            - 'null'
            - string
        proxy_id:
          type:
            - 'null'
            - string
          description: Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.
          deprecated: true
        random:
          type: object
          properties:
            group_events:
              type: number
        required_acks:
          enum:
            - 1
            - 0
            - -1
          type: integer
        round_robin:
          type: object
          properties:
            group_events:
              type: number
        sasl:
          type:
            - 'null'
            - object
          properties:
            mechanism:
              enum:
                - PLAIN
                - SCRAM-SHA-256
                - SCRAM-SHA-512
              type: string
        secrets:
          type: object
          properties:
            password:
              anyOf:
                - required:
                    - id
                  type: object
                  properties:
                    hash:
                      type: string
                    id:
                      type: string
                - type: string
            ssl:
              required:
                - key
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                    - type: string
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_ssl'
        timeout:
          type: number
        topic:
          type: string
        type:
          enum:
            - kafka
          type: string
        username:
          type:
            - 'null'
            - string
        version:
          type: string
    Kibana_HTTP_APIs_output_response_logstash:
      title: output_response_logstash
      required:
        - name
        - type
        - hosts
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                    - type: string
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_ssl'
        type:
          enum:
            - logstash
          type: string
    Kibana_HTTP_APIs_output_response_otlp:
      title: output_response_otlp
      required:
        - name
        - type
        - otlp_exporter
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otlp_exporter:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_otlp_response_grpc_exporter'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_otlp_response_http_exporter'
          discriminator:
            propertyName: protocol
            mapping:
              grpc: '#/components/schemas/Kibana_HTTP_APIs_otlp_response_grpc_exporter'
              http/protobuf: '#/components/schemas/Kibana_HTTP_APIs_otlp_response_http_exporter'
        secrets:
          type: object
          properties:
            otlp_exporter:
              type: object
              properties:
                tls:
                  type: object
                  properties:
                    key_pem:
                      anyOf:
                        - required:
                            - id
                          type: object
                          properties:
                            hash:
                              type: string
                            id:
                              type: string
                        - type: string
                    tpm:
                      type: object
                      properties:
                        auth:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                hash:
                                  type: string
                                id:
                                  type: string
                            - type: string
                        owner_auth:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                hash:
                                  type: string
                                id:
                                  type: string
                            - type: string
        type:
          enum:
            - otlp
          type: string
    Kibana_HTTP_APIs_output_response_remote_elasticsearch:
      title: output_response_remote_elasticsearch
      required:
        - name
        - type
        - hosts
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            format: uri
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        kibana_api_key:
          type:
            - 'null'
            - string
        kibana_url:
          type:
            - 'null'
            - string
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        preset:
          enum:
            - balanced
            - custom
            - throughput
            - scale
            - latency
          type: string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            service_token:
              anyOf:
                - required:
                    - id
                  type: object
                  properties:
                    hash:
                      type: string
                    id:
                      type: string
                - type: string
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                    - type: string
        service_token:
          type:
            - 'null'
            - string
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_response_ssl'
        sync_integrations:
          type: boolean
        sync_uninstalled_integrations:
          type: boolean
        type:
          enum:
            - remote_elasticsearch
          type: string
        write_to_logs_streams:
          type:
            - 'null'
            - boolean
    Kibana_HTTP_APIs_output_response_shipper:
      title: output_response_shipper
      type: object
      properties:
        compression_level:
          type:
            - 'null'
            - number
          default: 'null'
        disk_queue_compression_enabled:
          type:
            - 'null'
            - boolean
          default: 'null'
        disk_queue_enabled:
          type:
            - 'null'
            - boolean
          default: 'null'
        disk_queue_encryption_enabled:
          type:
            - 'null'
            - boolean
          default: 'null'
        disk_queue_max_size:
          type:
            - 'null'
            - number
          default: 'null'
        disk_queue_path:
          type:
            - 'null'
            - string
          default: 'null'
        loadbalance:
          type:
            - 'null'
            - boolean
          default: 'null'
        max_batch_bytes:
          type:
            - 'null'
            - number
          default: 'null'
        mem_queue_events:
          type:
            - 'null'
            - number
          default: 'null'
        queue_flush_timeout:
          type:
            - 'null'
            - number
          default: 'null'
    Kibana_HTTP_APIs_output_response_ssl:
      title: output_response_ssl
      type: object
      properties:
        certificate:
          type: string
        certificate_authorities:
          maxItems: 10
          type: array
          items:
            type: string
        key:
          type: string
        verification_mode:
          enum:
            - full
            - none
            - certificate
            - strict
          type: string
    Kibana_HTTP_APIs_output_shipper:
      title: output_shipper
      type: object
      properties:
        compression_level:
          type:
            - 'null'
            - number
          default: 'null'
        disk_queue_compression_enabled:
          type:
            - 'null'
            - boolean
          default: 'null'
        disk_queue_enabled:
          type:
            - 'null'
            - boolean
          default: 'null'
        disk_queue_encryption_enabled:
          type:
            - 'null'
            - boolean
          default: 'null'
        disk_queue_max_size:
          type:
            - 'null'
            - number
          default: 'null'
        disk_queue_path:
          type:
            - 'null'
            - string
          default: 'null'
        loadbalance:
          type:
            - 'null'
            - boolean
          default: 'null'
        max_batch_bytes:
          type:
            - 'null'
            - number
          default: 'null'
        mem_queue_events:
          type:
            - 'null'
            - number
          default: 'null'
        queue_flush_timeout:
          type:
            - 'null'
            - number
          default: 'null'
      additionalProperties: false
    Kibana_HTTP_APIs_output_ssl:
      title: output_ssl
      type: object
      properties:
        certificate:
          type: string
        certificate_authorities:
          maxItems: 10
          type: array
          items:
            type: string
        key:
          type: string
        verification_mode:
          enum:
            - full
            - none
            - certificate
            - strict
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_package_icon:
      title: package_icon
      required:
        - src
      type: object
      properties:
        dark_mode:
          type: boolean
        path:
          type: string
        size:
          type: string
        src:
          type: string
        title:
          type: string
        type:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_package_info_conditions_deprecation_info:
      title: package_info_conditions_deprecation_info
      required:
        - description
      type: object
      properties:
        description:
          maxLength: 4096
          type: string
        replaced_by:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
        since:
          maxLength: 50
          type: string
    Kibana_HTTP_APIs_package_info_deprecation_info:
      title: package_info_deprecation_info
      required:
        - description
      type: object
      properties:
        description:
          maxLength: 4096
          type: string
        replaced_by:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
        since:
          maxLength: 50
          type: string
    Kibana_HTTP_APIs_package_info_es_asset_reference:
      title: package_info_es_asset_reference
      required:
        - id
        - type
      type: object
      properties:
        customDataStreamOriginDataset:
          type: string
        customDataStreamOriginType:
          type: string
        deferred:
          type: boolean
        id:
          type: string
        type:
          enum:
            - index
            - index_template
            - component_template
            - ingest_pipeline
            - ilm_policy
            - data_stream_ilm_policy
            - transform
            - ml_model
            - knowledge_base
            - esql_view
          type: string
        version:
          type: string
    Kibana_HTTP_APIs_package_info_icon:
      title: package_info_icon
      required:
        - src
      type: object
      properties:
        dark_mode:
          type: boolean
        path:
          type: string
        size:
          type: string
        src:
          type: string
        title:
          type: string
        type:
          type: string
    Kibana_HTTP_APIs_package_info_installation_info:
      title: package_info_installation_info
      required:
        - type
        - installed_kibana
        - installed_es
        - name
        - version
        - install_status
        - install_source
        - verification_status
      type: object
      properties:
        additional_spaces_installed_kibana:
          type: object
          additionalProperties:
            maxItems: 100
            type: array
            items:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_kibana_asset_reference'
        created_at:
          type: string
        experimental_data_stream_features:
          maxItems: 100
          type: array
          items:
            required:
              - data_stream
              - features
            type: object
            properties:
              data_stream:
                maxLength: 1024
                type: string
              features:
                type: object
                properties:
                  doc_value_only_numeric:
                    type: boolean
                  doc_value_only_other:
                    type: boolean
                  synthetic_source:
                    type: boolean
                  tsdb:
                    type: boolean
        install_format_schema_version:
          type: string
        install_source:
          enum:
            - registry
            - upload
            - bundled
            - custom
          type: string
        install_status:
          enum:
            - installed
            - installing
            - install_failed
          type: string
        installed_es:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_es_asset_reference'
        installed_kibana:
          maxItems: 10000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_kibana_asset_reference'
        installed_kibana_space_id:
          type: string
        is_rollback_ttl_expired:
          type: boolean
        latest_executed_state:
          type: object
          properties:
            error:
              type: string
            name:
              type: string
            started_at:
              type: string
        latest_install_failed_attempts:
          maxItems: 10
          type: array
          items:
            required:
              - created_at
              - target_version
              - error
            type: object
            properties:
              created_at:
                type: string
              error:
                required:
                  - name
                  - message
                type: object
                properties:
                  message:
                    type: string
                  name:
                    type: string
                  stack:
                    type: string
              missing_assets:
                maxItems: 10000
                type: array
                items:
                  required:
                    - id
                    - type
                  type: object
                  properties:
                    id:
                      type: string
                    type:
                      type: string
              target_version:
                type: string
        name:
          type: string
        namespaces:
          maxItems: 100
          type: array
          items:
            type: string
        previous_version:
          type:
            - 'null'
            - string
        rolled_back:
          type: boolean
        type:
          type: string
        updated_at:
          type: string
        verification_key_id:
          type:
            - 'null'
            - string
        verification_status:
          enum:
            - unverified
            - verified
            - unknown
          type: string
        version:
          type: string
    Kibana_HTTP_APIs_package_info_kibana_asset_reference:
      title: package_info_kibana_asset_reference
      required:
        - id
        - type
      type: object
      properties:
        deferred:
          type: boolean
        id:
          type: string
        originId:
          type: string
        type:
          anyOf:
            - enum:
                - dashboard
                - lens
                - visualization
                - search
                - index-pattern
                - map
                - ml-module
                - security-rule
                - csp-rule-template
                - osquery-pack-asset
                - osquery-saved-query
                - tag
              type: string
            - type: string
    Kibana_HTTP_APIs_package_list_item:
      title: package_list_item
      required:
        - name
        - version
        - title
        - id
      type: object
      properties:
        categories:
          maxItems: 100
          type: array
          items:
            type: string
        conditions:
          type: object
          properties:
            deprecated:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_conditions_deprecation_info'
            elastic:
              type: object
              properties:
                capabilities:
                  maxItems: 10
                  type: array
                  items:
                    type: string
                subscription:
                  type: string
            kibana:
              type: object
              properties:
                version:
                  type: string
        data_streams:
          maxItems: 1000
          type: array
          items:
            type: object
            additionalProperties: { }
        deprecated:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_deprecation_info'
        description:
          type: string
        discovery:
          type: object
          properties:
            datasets:
              maxItems: 100
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
            fields:
              maxItems: 100
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
        download:
          type: string
        format_version:
          type: string
        icons:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_icon'
        id:
          type: string
        installationInfo:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_info_installation_info'
        integration:
          type: string
        internal:
          type: boolean
        latestVersion:
          type: string
        name:
          type: string
        owner:
          type: object
          properties:
            github:
              type: string
            type:
              enum:
                - elastic
                - partner
                - community
              type: string
        path:
          type: string
        policy_templates:
          maxItems: 1000
          type: array
          items:
            type: object
            additionalProperties: { }
        readme:
          type: string
        release:
          enum:
            - ga
            - beta
            - experimental
          type: string
        signature_path:
          type: string
        source:
          required:
            - license
          type: object
          properties:
            license:
              type: string
        status:
          type: string
        title:
          type: string
        type:
          anyOf:
            - enum:
                - integration
              type: string
            - enum:
                - input
              type: string
            - enum:
                - content
              type: string
            - type: string
        var_groups:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - title
              - selector_title
              - options
            type: object
            properties:
              description:
                type: string
              name:
                type: string
              options:
                maxItems: 100
                type: array
                items:
                  required:
                    - name
                    - title
                    - vars
                  type: object
                  properties:
                    description:
                      type: string
                    hide_in_deployment_modes:
                      maxItems: 2
                      type: array
                      items:
                        enum:
                          - default
                          - agentless
                        type: string
                    name:
                      type: string
                    title:
                      type: string
                    vars:
                      maxItems: 100
                      type: array
                      items:
                        type: string
              selector_title:
                type: string
              title:
                type: string
        vars:
          maxItems: 1000
          type: array
          items:
            type: object
            additionalProperties: { }
        version:
          type: string
    Kibana_HTTP_APIs_package_metadata:
      title: package_metadata
      required:
        - has_policies
      type: object
      properties:
        has_policies:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_package_policy_input_deprecation_info:
      title: package_policy_input_deprecation_info
      required:
        - description
      type: object
      properties:
        description:
          maxLength: 4096
          type: string
        replaced_by:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
        since:
          maxLength: 50
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_package_policy_package:
      title: package_policy_package
      required:
        - name
        - version
      type: object
      properties:
        experimental_data_stream_features:
          maxItems: 100
          type: array
          items:
            required:
              - data_stream
              - features
            type: object
            properties:
              data_stream:
                maxLength: 1024
                type: string
              features:
                type: object
                properties:
                  doc_value_only_numeric:
                    type: boolean
                  doc_value_only_other:
                    type: boolean
                  synthetic_source:
                    type: boolean
                  tsdb:
                    type: boolean
                additionalProperties: false
            additionalProperties: false
        fips_compatible:
          type: boolean
        name:
          maxLength: 255
          type: string
          description: Package name
        requires_root:
          type: boolean
        title:
          maxLength: 255
          type: string
        version:
          maxLength: 50
          type: string
          description: Package version
      additionalProperties: false
    Kibana_HTTP_APIs_package_policy_response:
      title: package_policy_response
      required:
        - name
        - enabled
        - inputs
        - id
        - revision
        - updated_at
        - updated_by
        - created_at
        - created_by
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        agents:
          type: number
        cloud_connector_id:
          type:
            - 'null'
            - string
          description: ID of the cloud connector associated with this package policy.
        cloud_connector_name:
          maxLength: 255
          minLength: 1
          type:
            - 'null'
            - string
          description: Transient field for cloud connector name during creation.
        condition:
          maxLength: 10000
          type:
            - 'null'
            - string
          description: Agent condition expression to evaluate whether to apply this integration to its inputs.
        created_at:
          type: string
        created_by:
          type: string
        description:
          type: string
          description: Package policy description
        elasticsearch:
          type: object
          properties:
            privileges:
              type: object
              properties:
                cluster:
                  maxItems: 100
                  type: array
                  items:
                    type: string
        enabled:
          type: boolean
        global_data_tags:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
                description: The name of the custom field. Cannot contain spaces.
              value:
                type:
                  - number
                  - string
                description: The value of the custom field.
            additionalProperties: false
        id:
          type: string
          description: Package policy unique identifier.
        inputs:
          anyOf:
            - maxItems: 100
              type: array
              items:
                required:
                  - type
                  - enabled
                  - streams
                  - compiled_input
                type: object
                properties:
                  compiled_input: { }
                  condition:
                    maxLength: 10000
                    type:
                      - 'null'
                      - string
                    description: Agent condition expression to evaluate whether to apply this input.
                  config:
                    type: object
                    additionalProperties:
                      required:
                        - value
                      type: object
                      properties:
                        frozen:
                          type: boolean
                        type:
                          type: string
                        value: { }
                      additionalProperties: false
                    description: Package variable (see integration documentation for more information)
                  deprecated:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info'
                  enabled:
                    type: boolean
                  id:
                    type: string
                  keep_enabled:
                    type: boolean
                  migrate_from:
                    type: string
                  name:
                    type: string
                  policy_template:
                    type: string
                  streams:
                    maxItems: 1000
                    type: array
                    items:
                      required:
                        - enabled
                        - data_stream
                        - compiled_stream
                      type: object
                      properties:
                        compiled_stream: { }
                        condition:
                          maxLength: 10000
                          type:
                            - 'null'
                            - string
                          description: Agent condition expression to evaluate whether to apply this stream.
                        config:
                          type: object
                          additionalProperties:
                            required:
                              - value
                            type: object
                            properties:
                              frozen:
                                type: boolean
                              type:
                                type: string
                              value: { }
                            additionalProperties: false
                          description: Package variable (see integration documentation for more information)
                        data_stream:
                          required:
                            - dataset
                          type: object
                          properties:
                            dataset:
                              type: string
                            elasticsearch:
                              type: object
                              properties:
                                dynamic_dataset:
                                  type: boolean
                                dynamic_namespace:
                                  type: boolean
                                privileges:
                                  type: object
                                  properties:
                                    indices:
                                      maxItems: 100
                                      type: array
                                      items:
                                        type: string
                                  additionalProperties: false
                              additionalProperties: false
                            type:
                              type: string
                          additionalProperties: false
                        deprecated:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info'
                        enabled:
                          type: boolean
                        id:
                          type: string
                        keep_enabled:
                          type: boolean
                        migrate_from:
                          type: string
                        release:
                          enum:
                            - ga
                            - beta
                            - experimental
                          type: string
                        var_group_selections:
                          type: object
                          additionalProperties:
                            maxLength: 1024
                            type: string
                          description: Variable group selections. Maps var_group name to the selected option name within that group.
                        vars:
                          type: object
                          additionalProperties:
                            required:
                              - value
                            type: object
                            properties:
                              frozen:
                                type: boolean
                              type:
                                type: string
                              value: { }
                            additionalProperties: false
                          description: Package variable (see integration documentation for more information)
                      additionalProperties: false
                  type:
                    type: string
                  var_group_selections:
                    type: object
                    additionalProperties:
                      maxLength: 1024
                      type: string
                    description: Variable group selections. Maps var_group name to the selected option name within that group.
                  vars:
                    type: object
                    additionalProperties:
                      required:
                        - value
                      type: object
                      properties:
                        frozen:
                          type: boolean
                        type:
                          type: string
                        value: { }
                      additionalProperties: false
                    description: Package variable (see integration documentation for more information)
                additionalProperties: false
            - type: object
              additionalProperties:
                type: object
                properties:
                  condition:
                    maxLength: 10000
                    type:
                      - 'null'
                      - string
                    description: Agent condition expression to evaluate whether to apply this input.
                  deprecated:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info'
                  enabled:
                    type: boolean
                    description: Enable or disable that input. Defaults to `true` (enabled).
                  streams:
                    type: object
                    additionalProperties:
                      type: object
                      properties:
                        condition:
                          maxLength: 10000
                          type:
                            - 'null'
                            - string
                          description: Agent condition expression to evaluate whether to apply this stream.
                        deprecated:
                          $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info'
                        enabled:
                          type: boolean
                          description: Enable or disable that stream. Defaults to `true` (enabled).
                        var_group_selections:
                          type: object
                          additionalProperties:
                            maxLength: 1024
                            type: string
                          description: Variable group selections. Maps var_group name to the selected option name within that group.
                        vars:
                          type: object
                          additionalProperties:
                            anyOf:
                              - maxLength: 10000
                                type: string
                              - type: number
                              - type: boolean
                              - maxItems: 100
                                type: array
                                items:
                                  maxLength: 10000
                                  type: string
                              - maxItems: 100
                                type: array
                                items:
                                  type: number
                              - required:
                                  - id
                                  - isSecretRef
                                type: object
                                properties:
                                  id:
                                    maxLength: 255
                                    type: string
                                  isSecretRef:
                                    type: boolean
                                additionalProperties: false
                            default: 'null'
                          description: Input/stream level variable. Refer to the integration documentation for more information.
                      additionalProperties: false
                    description: Input streams. Refer to the integration documentation to know which streams are available.
                  vars:
                    type: object
                    additionalProperties:
                      anyOf:
                        - maxLength: 10000
                          type: string
                        - type: number
                        - type: boolean
                        - maxItems: 100
                          type: array
                          items:
                            maxLength: 10000
                            type: string
                        - maxItems: 100
                          type: array
                          items:
                            type: number
                        - required:
                            - id
                            - isSecretRef
                          type: object
                          properties:
                            id:
                              maxLength: 255
                              type: string
                            isSecretRef:
                              type: boolean
                          additionalProperties: false
                      default: 'null'
                    description: Input/stream level variable. Refer to the integration documentation for more information.
                additionalProperties: false
              description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
          description: Package policy inputs.
        is_managed:
          type: boolean
        name:
          type: string
          description: Unique name for the package policy.
        namespace:
          maxLength: 100
          type: string
          description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
        output_id:
          type:
            - 'null'
            - string
        overrides:
          type:
            - 'null'
            - object
          properties:
            inputs:
              type: object
              additionalProperties: { }
          additionalProperties: false
          description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        package_agent_version_condition:
          type: string
        policy_id:
          type:
            - 'null'
            - string
          description: ID of the agent policy which the package policy will be added to.
          deprecated: true
        policy_ids:
          maxItems: 1000
          type: array
          items:
            type: string
            description: IDs of the agent policies that the package policy will be added to.
        revision:
          type: number
          description: Package policy revision.
        secret_references:
          maxItems: 1000
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
            additionalProperties: false
        spaceIds:
          maxItems: 100
          type: array
          items:
            type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy belongs to an agentless agent policy.
        supports_cloud_connector:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy supports cloud connectors.
        updated_at:
          type: string
        updated_by:
          type: string
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          anyOf:
            - type: object
              additionalProperties:
                required:
                  - value
                type: object
                properties:
                  frozen:
                    type: boolean
                  type:
                    type: string
                  value: { }
                additionalProperties: false
              description: Package variable (see integration documentation for more information)
            - type: object
              additionalProperties:
                anyOf:
                  - maxLength: 10000
                    type: string
                  - type: number
                  - type: boolean
                  - maxItems: 100
                    type: array
                    items:
                      maxLength: 10000
                      type: string
                  - maxItems: 100
                    type: array
                    items:
                      type: number
                  - required:
                      - id
                      - isSecretRef
                    type: object
                    properties:
                      id:
                        maxLength: 255
                        type: string
                      isSecretRef:
                        type: boolean
                    additionalProperties: false
                default: 'null'
              description: Input/stream level variable. Refer to the integration documentation for more information.
          description: Package level variable.
        version:
          type: string
          description: Package policy ES version.
      additionalProperties: false
    Kibana_HTTP_APIs_package_policy_status_response:
      title: package_policy_status_response
      required:
        - id
        - success
      type: object
      properties:
        body:
          required:
            - message
          type: object
          properties:
            message:
              type: string
          additionalProperties: false
        id:
          type: string
        name:
          type: string
        statusCode:
          type: number
        success:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_package_policy_stream_deprecation_info:
      title: package_policy_stream_deprecation_info
      required:
        - description
      type: object
      properties:
        description:
          maxLength: 4096
          type: string
        replaced_by:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
        since:
          maxLength: 50
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_pieLibItemNoESQL:
      title: Pie Chart (library)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metric configurations (minimum 1)
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - pie
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_QueryStreamUpsertRequest:
      required:
        - dashboards
        - rules
        - stream
      type: object
      properties:
        dashboards:
          type: array
          items:
            type: string
        rules:
          type: array
          items:
            type: string
        stream:
          required:
            - description
            - type
            - query
          type: object
          properties:
            description:
              type: string
            field_descriptions:
              type: object
              additionalProperties:
                type: string
            query:
              required:
                - view
                - esql
              type: object
              properties:
                esql:
                  type: string
                view:
                  type: string
              additionalProperties: false
            query_streams:
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
            type:
              enum:
                - query
              type: string
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_reauthorize_transform_request:
      title: reauthorize_transform_request
      required:
        - transforms
      type: object
      properties:
        transforms:
          maxItems: 1000
          type: array
          items:
            required:
              - transformId
            type: object
            properties:
              transformId:
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_RecursiveRecord:
      type: object
      additionalProperties:
        anyOf:
          - anyOf:
              - maxLength: 65535
                type: string
              - type: number
              - type: boolean
              - { }
          - type: array
            items:
              anyOf:
                - maxLength: 65535
                  type: string
                - type: number
                - type: boolean
                - { }
          - type: array
            items:
              anyOf:
                - anyOf:
                    - maxLength: 65535
                      type: string
                    - type: number
                    - type: boolean
                    - { }
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
          - $ref: '#/components/schemas/Kibana_HTTP_APIs_RecursiveRecord'
    Kibana_HTTP_APIs_regionMapLibItemNoESQL:
      title: Region Map Chart (library)
      required:
        - type
        - data_source
        - metric
        - region
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          title: Field Metric or Formula Operation
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
          description: Metric dimension using a field-based aggregation or a mathematical formula.
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        region:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                ems:
                  required:
                    - boundaries
                    - join
                  type: object
                  properties:
                    boundaries:
                      type: string
                      description: EMS boundaries
                    join:
                      type: string
                      description: EMS join field
                  additionalProperties: false
              additionalProperties: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - region_map
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_review_upgrade_request:
      title: review_upgrade_request
      required:
        - action
        - target_version
      type: object
      properties:
        action:
          enum:
            - accept
            - decline
            - pending
          type: string
        target_version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_review_upgrade_response:
      title: review_upgrade_response
      required:
        - success
      type: object
      properties:
        success:
          type: boolean
      additionalProperties: false
    Kibana_HTTP_APIs_rollback_package_response:
      title: rollback_package_response
      required:
        - version
        - success
      type: object
      properties:
        success:
          type: boolean
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_rule_flapping:
      title: rule_flapping
      required:
        - look_back_window
        - status_change_threshold
      type: object
      properties:
        enabled:
          type: boolean
          description: 'Determines whether the rule can enter the flapping state. By default, rules can enter the flapping state.'
        look_back_window:
          maximum: 20
          minimum: 2
          type: number
          description: The minimum number of runs in which the threshold must be met.
        status_change_threshold:
          maximum: 20
          minimum: 2
          type: number
          description: The minimum number of times an alert must switch states within the defined look back window time.
      additionalProperties: false
      description: 'When flapping detection is turned on, alerts that switch quickly between active and recovered states are identified as “flapping” and notifications are reduced.'
    Kibana_HTTP_APIs_rule_response:
      title: rule_response
      required:
        - id
        - enabled
        - name
        - tags
        - rule_type_id
        - consumer
        - schedule
        - actions
        - params
        - created_at
        - updated_at
        - mute_all
        - muted_alert_ids
        - execution_status
        - revision
      type: object
      properties:
        actions:
          type: array
          items:
            required:
              - id
              - connector_type_id
              - params
            type: object
            properties:
              alerts_filter:
                type: object
                properties:
                  query:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_alerts_filter_query'
                  timeframe:
                    required:
                      - days
                      - hours
                      - timezone
                    type: object
                    properties:
                      days:
                        type: array
                        items:
                          enum:
                            - 1
                            - 2
                            - 3
                            - 4
                            - 5
                            - 6
                            - 7
                          type: integer
                        description: 'Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.'
                      hours:
                        required:
                          - start
                          - end
                        type: object
                        properties:
                          end:
                            type: string
                            description: 'The end of the time frame, in 24-hour notation (`hh:mm`).'
                          start:
                            type: string
                            description: 'The start of the time frame, in 24-hour notation (`hh:mm`).'
                        additionalProperties: false
                      timezone:
                        type: string
                        description: The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended.
                    additionalProperties: false
                additionalProperties: false
                description: Defines a period that limits whether the action runs.
              connector_type_id:
                type: string
                description: The type of connector. This property appears in responses but cannot be set in requests.
              frequency:
                required:
                  - summary
                  - notify_when
                type: object
                properties:
                  notify_when:
                    enum:
                      - onActionGroupChange
                      - onActiveAlert
                      - onThrottleInterval
                    type: string
                    description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
                  summary:
                    type: boolean
                    description: Indicates whether the action is a summary.
                  throttle:
                    type:
                      - 'null'
                      - string
                    description: 'The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when ''notify_when'' is set to ''onThrottleInterval''. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
                    default: 'null'
                additionalProperties: false
              group:
                type: string
                description: 'The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don''t need to group actions, set to `default`.'
              id:
                type: string
                description: The identifier for the connector saved object.
              params:
                type: object
                additionalProperties: { }
                description: 'The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.'
              use_alert_data_for_template:
                type: boolean
                description: Indicates whether to use alert data as a template.
              uuid:
                type: string
                description: A universally unique identifier (UUID) for the action.
            additionalProperties: false
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        api_key_created_by_user:
          type:
            - 'null'
            - boolean
          description: Indicates whether the API key that is associated with the rule was created by the user.
        api_key_owner:
          type:
            - 'null'
            - string
          description: The owner of the API key that is associated with the rule and used to run background tasks.
          default: 'null'
        artifacts:
          type: object
          properties:
            dashboards:
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  type: string
                  description: User-created content that describes alert causes and remediation.
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        created_at:
          type: string
          description: The date and time that the rule was created.
        created_by:
          type:
            - 'null'
            - string
          description: The identifier for the user that created the rule.
          default: 'null'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
        execution_status:
          required:
            - status
            - last_execution_date
          type: object
          properties:
            error:
              required:
                - reason
                - message
              type: object
              properties:
                message:
                  type: string
                  description: Error message.
                reason:
                  enum:
                    - read
                    - decrypt
                    - execute
                    - unknown
                    - license
                    - timeout
                    - disabled
                    - validate
                  type: string
                  description: Reason for error.
              additionalProperties: false
            last_duration:
              type: number
              description: Duration of last rule execution.
            last_execution_date:
              type: string
              description: The date and time of the last rule execution.
            status:
              enum:
                - ok
                - active
                - error
                - warning
                - pending
                - unknown
              type: string
              description: Status of rule execution.
            warning:
              required:
                - reason
                - message
              type: object
              properties:
                message:
                  type: string
                  description: Warning message.
                reason:
                  enum:
                    - maxExecutableActions
                    - maxAlerts
                    - maxQueuedActions
                    - ruleExecution
                  type: string
                  description: Reason for warning.
              additionalProperties: false
          additionalProperties: false
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        id:
          type: string
          description: The identifier for the rule.
        last_run:
          required:
            - outcome
            - alerts_count
          type:
            - 'null'
            - object
          properties:
            alerts_count:
              type: object
              properties:
                active:
                  type:
                    - 'null'
                    - number
                  description: Number of active alerts during last run.
                ignored:
                  type:
                    - 'null'
                    - number
                  description: Number of ignored alerts during last run.
                new:
                  type:
                    - 'null'
                    - number
                  description: Number of new alerts during last run.
                recovered:
                  type:
                    - 'null'
                    - number
                  description: Number of recovered alerts during last run.
              additionalProperties: false
            outcome:
              enum:
                - succeeded
                - warning
                - failed
              type: string
              description: 'Outcome of the last rule run. Value can be succeeded, warning, or failed.'
            outcome_msg:
              type:
                - 'null'
                - array
              items:
                type: string
                description: Outcome message generated during last rule run.
            outcome_order:
              type: number
              description: Order of the outcome.
            warning:
              enum:
                - read
                - decrypt
                - execute
                - unknown
                - license
                - timeout
                - disabled
                - validate
                - maxExecutableActions
                - maxAlerts
                - maxQueuedActions
                - ruleExecution
                - 'null'
              type:
                - 'null'
                - string
              description: Warning of last rule execution.
          additionalProperties: false
        mapped_params:
          type: object
          additionalProperties: { }
        mute_all:
          type: boolean
          description: Indicates whether all alerts are muted.
        muted_alert_ids:
          type: array
          items:
            type: string
            description: 'List of identifiers of muted alerts. '
        name:
          type: string
          description: ' The name of the rule.'
        next_run:
          type:
            - 'null'
            - string
          description: Date and time of the next rule run.
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          type: object
          additionalProperties: { }
          description: The parameters for the rule.
        revision:
          type: number
          description: The rule revision number.
        rule_type_id:
          type: string
          description: The rule type identifier.
        running:
          type:
            - 'null'
            - boolean
          description: Indicates whether the rule is running.
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
        scheduled_task_id:
          type: string
          description: Identifier of the scheduled task.
        tags:
          type: array
          items:
            type: string
            description: The tags for the rule.
        throttle:
          type:
            - 'null'
            - string
          description: 'Deprecated in 8.13.0. Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
          deprecated: true
        updated_at:
          type: string
          description: The date and time of the latest updates to the rule.
        updated_by:
          type:
            - 'null'
            - string
          description: The identifier for the user who was the last to update the rule.
          default: 'null'
      additionalProperties: false
    Kibana_HTTP_APIs_schedule_request:
      title: schedule_request
      required:
        - start
        - duration
      type: object
      properties:
        duration:
          maxLength: 100
          type: string
          description: 'The duration of the schedule. It allows values in `<integer><unit>` format. `<unit>` is one of `d`, `h`, `m`, or `s` for hours, minutes, seconds. For example: `1d`, `5h`, `30m`, `5000s`.'
        recurring:
          type: object
          properties:
            end:
              maxLength: 100
              type: string
              description: 'The end date of a recurring schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-04-01T00:00:00.000Z`.'
            every:
              maxLength: 100
              type: string
              description: 'The interval and frequency of a recurring schedule. It allows values in `<integer><unit>` format. `<unit>` is one of `d`, `w`, `M`, or `y` for days, weeks, months, years. For example: `15d`, `2w`, `3m`, `1y`.'
            occurrences:
              minimum: 1
              type: number
              description: The total number of recurrences of the schedule.
            onMonth:
              maxItems: 12
              minItems: 1
              type: array
              items:
                maximum: 12
                minimum: 1
                type: number
              description: The specific months for a recurring schedule. Valid values are 1-12.
            onMonthDay:
              maxItems: 31
              minItems: 1
              type: array
              items:
                maximum: 31
                minimum: 1
                type: number
              description: The specific days of the month for a recurring schedule. Valid values are 1-31.
            onWeekDay:
              maxItems: 77
              minItems: 1
              type: array
              items:
                maxLength: 10
                type: string
              description: 'The specific days of the week (`[MO,TU,WE,TH,FR,SA,SU]`) or nth day of month (`[+1MO, -3FR, +2WE, -4SA, -5SU]`) for a recurring schedule.'
          additionalProperties: false
        start:
          maxLength: 100
          type: string
          description: 'The start date and time of the schedule, provided in ISO 8601 format and set to the UTC timezone. For example: `2025-03-12T12:00:00.000Z`.'
        timezone:
          maxLength: 64
          type: string
          description: The timezone of the schedule. The default timezone is UTC.
      additionalProperties: false
    Kibana_HTTP_APIs_security_bulk_create_or_update_roles_response:
      title: security_bulk_create_or_update_roles_response
      type: object
      properties:
        created:
          type: array
          items:
            type: string
            description: The name of a role that was created.
        errors:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_bulk_roles_error_detail'
        noop:
          type: array
          items:
            type: string
            description: The name of a role that was unchanged by the request.
        updated:
          type: array
          items:
            type: string
            description: The name of a role that was updated.
      additionalProperties: false
      description: The response payload for the bulk create-or-update roles API.
    Kibana_HTTP_APIs_security_bulk_roles_error_detail:
      title: security_bulk_roles_error_detail
      required:
        - type
        - reason
      type: object
      properties:
        reason:
          type: string
          description: A human readable error reason.
        type:
          type: string
          description: The error type.
      additionalProperties: false
      description: Error information for a single role in a bulk create-or-update request.
    Kibana_HTTP_APIs_security_query_roles_body:
      title: security_query_roles_body
      type: object
      properties:
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_filters'
        from:
          type: number
        query:
          type: string
        size:
          type: number
        sort:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_security_query_roles_sort'
      additionalProperties: false
      description: The request body for querying roles.
    Kibana_HTTP_APIs_security_query_roles_filters:
      title: security_query_roles_filters
      type: object
      properties:
        showReservedRoles:
          type: boolean
      additionalProperties: false
      description: The filter criteria for the query.
    Kibana_HTTP_APIs_security_query_roles_response:
      title: security_query_roles_response
      required:
        - roles
        - count
        - total
      type: object
      properties:
        count:
          type: number
          description: The number of roles returned in this response page.
        roles:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_response'
        total:
          type: number
          description: The total number of roles that match the query.
      additionalProperties: false
      description: The response payload for a roles query.
    Kibana_HTTP_APIs_security_query_roles_sort:
      title: security_query_roles_sort
      required:
        - field
        - direction
      type: object
      properties:
        direction:
          enum:
            - asc
            - desc
          type: string
        field:
          type: string
      additionalProperties: false
      description: The sort criteria for the query.
    Kibana_HTTP_APIs_security_role_data_source_privileges:
      title: security_role_data_source_privileges
      required:
        - names
        - privileges
      type: object
      properties:
        names:
          maxItems: 100
          minItems: 1
          type: array
          items:
            maxLength: 1000
            type: string
            description: A list of data source names or wildcard patterns to which the permissions in this entry apply.
        privileges:
          maxItems: 5
          minItems: 1
          type: array
          items:
            enum:
              - create
              - read_metadata
              - delete
              - read
              - manage
            type: string
          description: The data source privileges that role members have for the specified data sources.
      additionalProperties: false
      description: The data source privileges entry.
    Kibana_HTTP_APIs_security_role_elasticsearch:
      title: security_role_elasticsearch
      type: object
      properties:
        cluster:
          maxItems: 100
          type: array
          items:
            type: string
            description: Cluster privileges that define the cluster level actions that users can perform.
        global:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_global_privileges'
        indices:
          maxItems: 1000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_indices_privileges'
        remote_cluster:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_remote_cluster_privileges'
        remote_indices:
          maxItems: 1000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_remote_indices_privileges'
        run_as:
          maxItems: 100
          type: array
          items:
            type: string
            description: A username that members of this role can impersonate.
      additionalProperties: false
      description: 'The Elasticsearch cluster, index, and remote cluster security privileges for the role.'
    Kibana_HTTP_APIs_security_role_global_privileges:
      title: security_role_global_privileges
      type: object
      properties:
        application:
          type: object
          properties:
            manage:
              required:
                - applications
              type: object
              properties:
                applications:
                  maxItems: 1000
                  type: array
                  items:
                    maxLength: 100
                    type: string
                    description: A list of application names that the role can manage at the global privilege scope.
              additionalProperties: false
          additionalProperties: false
        data_source:
          maxItems: 1000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_data_source_privileges'
        profile:
          type: object
          properties:
            write:
              required:
                - applications
              type: object
              properties:
                applications:
                  maxItems: 1000
                  type: array
                  items:
                    maxLength: 100
                    type: string
                    description: A list of application names whose user profile data the role can write at the global privilege scope.
              additionalProperties: false
          additionalProperties: false
        role:
          type: object
          description: Global role privileges.
      additionalProperties: false
      description: Global privileges for the role.
    Kibana_HTTP_APIs_security_role_indices_privileges:
      title: security_role_indices_privileges
      required:
        - names
        - privileges
      type: object
      properties:
        allow_restricted_indices:
          type: boolean
          description: 'Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field covers the restricted indices too.'
        field_security:
          type: object
          additionalProperties:
            maxItems: 1000
            type: array
            items:
              type: string
              description: The document fields that the role members have read access to.
        names:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: 'The data streams, indices, and aliases to which the permissions in this entry apply. It supports wildcards (*).'
        privileges:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: The index level privileges that the role members have for the data streams and indices.
        query:
          type: string
          description: A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members.
      additionalProperties: false
      description: The indices privileges entry.
    Kibana_HTTP_APIs_security_role_kibana_application:
      title: security_role_kibana_application
      required:
        - application
        - privileges
        - resources
      type: object
      properties:
        application:
          type: string
        privileges:
          type: array
          items:
            type: string
        resources:
          type: array
          items:
            type: string
      additionalProperties: false
      description: A raw Elasticsearch application privilege entry tied to Kibana.
    Kibana_HTTP_APIs_security_role_kibana_privilege:
      title: security_role_kibana_privilege
      required:
        - base
      type: object
      properties:
        base:
          anyOf:
            - type: array
              items: { }
            - type: boolean
            - type: number
            - type: object
            - type: string
          oneOf:
            - maxItems: 50
              type: array
              items:
                type: string
                description: A base privilege that grants applies to all spaces.
            - maxItems: 50
              type: array
              items:
                type: string
                description: A base privilege that applies to specific spaces.
        feature:
          type: object
          additionalProperties:
            maxItems: 100
            type: array
            items:
              type: string
              description: The privileges that the role member has for the feature.
        spaces:
          anyOf:
            - maxItems: 1
              minItems: 1
              type: array
              items:
                enum:
                  - '*'
                type: string
            - maxItems: 1000
              type: array
              items:
                type: string
                description: A space that the privilege applies to.
          default:
            - '*'
      additionalProperties: false
      description: The Kibana privilege entry for the role.
    Kibana_HTTP_APIs_security_role_kibana_privilege_response:
      title: security_role_kibana_privilege_response
      required:
        - spaces
        - base
        - feature
      type: object
      properties:
        _reserved:
          type: array
          items:
            type: string
            description: A reserved Kibana privilege granted globally.
        base:
          type: array
          items:
            type: string
            description: A base Kibana privilege.
        feature:
          type: object
          additionalProperties:
            type: array
            items:
              type: string
              description: A privilege the role member has for the feature.
        spaces:
          type: array
          items:
            type: string
            description: A space that the privilege applies to. The wildcard `*` indicates all spaces.
      additionalProperties: false
      description: A Kibana privilege entry returned for a role.
    Kibana_HTTP_APIs_security_role_put_payload:
      title: security_role_put_payload
      required:
        - elasticsearch
      type: object
      properties:
        description:
          maxLength: 2048
          type: string
          description: A description for the role.
        elasticsearch:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_elasticsearch'
        kibana:
          maxItems: 1000
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_privilege'
        metadata:
          type: object
          additionalProperties: { }
      additionalProperties: false
      description: The role definition to create or update.
    Kibana_HTTP_APIs_security_role_remote_cluster_privileges:
      title: security_role_remote_cluster_privileges
      required:
        - privileges
        - clusters
      type: object
      properties:
        clusters:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions.
        privileges:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: The cluster level privileges for the remote cluster. The allowed values are a subset of the cluster privileges.
      additionalProperties: false
      description: The remote cluster privileges entry.
    Kibana_HTTP_APIs_security_role_remote_indices_privileges:
      title: security_role_remote_indices_privileges
      required:
        - clusters
        - names
        - privileges
      type: object
      properties:
        allow_restricted_indices:
          type: boolean
          description: 'Restricted indices are a special category of indices that are used internally to store configuration data and should not be directly accessed. Only internal system roles should normally grant privileges over the restricted indices. Toggling this flag is very strongly discouraged because it could effectively grant unrestricted operations on critical data, making the entire system unstable or leaking sensitive information. If for administrative purposes you need to create a role with privileges covering restricted indices, however, you can set this property to true. In that case, the names field will cover the restricted indices too.'
        clusters:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: A list of remote cluster aliases. It supports literal strings as well as wildcards and regular expressions.
        field_security:
          type: object
          additionalProperties:
            maxItems: 1000
            type: array
            items:
              type: string
              description: The document fields that the role members have read access to.
        names:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: 'A list of remote aliases, data streams, or indices to which the permissions apply. It supports wildcards (*).'
        privileges:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            description: The index level privileges that role members have for the specified indices.
        query:
          type: string
          description: 'A search query that defines the documents the role members have read access to. A document within the specified data streams and indices must match this query in order for it to be accessible by the role members. '
      additionalProperties: false
      description: The remote indices privileges entry.
    Kibana_HTTP_APIs_security_role_response:
      title: security_role_response
      required:
        - name
        - elasticsearch
        - kibana
      type: object
      properties:
        _transform_error:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_transform_error'
        _unrecognized_applications:
          type: array
          items:
            type: string
            description: Application names found on the role that are not recognized by Kibana.
        description:
          type: string
          description: A description for the role.
        elasticsearch:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_elasticsearch'
        kibana:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_privilege_response'
        metadata:
          type: object
          additionalProperties: { }
        name:
          type: string
          description: The role name.
        transient_metadata:
          type: object
          additionalProperties: { }
      additionalProperties: false
      description: A Kibana role definition returned by the Roles API.
    Kibana_HTTP_APIs_security_role_transform_error:
      title: security_role_transform_error
      required:
        - reason
      type: object
      properties:
        reason:
          type: string
          description: The reason the role could not be fully transformed.
        state:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_kibana_application'
      additionalProperties: false
      description: Diagnostic information about a role whose Kibana privileges could not be transformed.
    Kibana_HTTP_APIs_security_roles_bulk_create_or_update_payload:
      title: security_roles_bulk_create_or_update_payload
      required:
        - roles
      type: object
      properties:
        roles:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_security_role_put_payload'
      additionalProperties: false
      description: The request body for bulk creating or updating roles.
    Kibana_HTTP_APIs_simplified_create_package_policy_request:
      title: simplified_create_package_policy_request
      required:
        - name
        - package
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            maxLength: 256
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        condition:
          maxLength: 10000
          type:
            - 'null'
            - string
          description: Agent condition expression to evaluate whether to apply this integration to its inputs.
        create_dataset_templates:
          type: boolean
          description: 'When true, install dedicated index templates for streams with a custom data_stream.dataset. Defaults to true for input packages, false for integration packages.'
        description:
          maxLength: 2048
          type: string
          description: Policy description.
        force:
          type: boolean
          description: 'Force package policy creation even if the package is not verified, or if the agent policy is managed.'
        id:
          maxLength: 255
          type: string
          description: Policy unique identifier.
        inputs:
          type: object
          additionalProperties:
            type: object
            properties:
              condition:
                maxLength: 10000
                type:
                  - 'null'
                  - string
                description: Agent condition expression to evaluate whether to apply this input.
              deprecated:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info'
              enabled:
                type: boolean
                description: Enable or disable that input. Defaults to `true` (enabled).
              streams:
                type: object
                additionalProperties:
                  type: object
                  properties:
                    condition:
                      maxLength: 10000
                      type:
                        - 'null'
                        - string
                      description: Agent condition expression to evaluate whether to apply this stream.
                    deprecated:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info'
                    enabled:
                      type: boolean
                      description: Enable or disable that stream. Defaults to `true` (enabled).
                    var_group_selections:
                      type: object
                      additionalProperties:
                        maxLength: 1024
                        type: string
                      description: Variable group selections. Maps var_group name to the selected option name within that group.
                    vars:
                      type: object
                      additionalProperties:
                        anyOf:
                          - maxLength: 10000
                            type: string
                          - type: number
                          - type: boolean
                          - maxItems: 100
                            type: array
                            items:
                              maxLength: 10000
                              type: string
                          - maxItems: 100
                            type: array
                            items:
                              type: number
                          - required:
                              - id
                              - isSecretRef
                            type: object
                            properties:
                              id:
                                maxLength: 255
                                type: string
                              isSecretRef:
                                type: boolean
                            additionalProperties: false
                        default: 'null'
                      description: Input/stream level variable. Refer to the integration documentation for more information.
                  additionalProperties: false
                description: Input streams. Refer to the integration documentation to know which streams are available.
              vars:
                type: object
                additionalProperties:
                  anyOf:
                    - maxLength: 10000
                      type: string
                    - type: number
                    - type: boolean
                    - maxItems: 100
                      type: array
                      items:
                        maxLength: 10000
                        type: string
                    - maxItems: 100
                      type: array
                      items:
                        type: number
                    - required:
                        - id
                        - isSecretRef
                      type: object
                      properties:
                        id:
                          maxLength: 255
                          type: string
                        isSecretRef:
                          type: boolean
                      additionalProperties: false
                  default: 'null'
                description: Input/stream level variable. Refer to the integration documentation for more information.
            additionalProperties: false
          description: Package policy inputs. Refer to the integration documentation to know which inputs are available.
        name:
          maxLength: 255
          type: string
          description: Unique name for the policy.
        namespace:
          maxLength: 100
          type: string
          description: 'Policy namespace. When not specified, it inherits the agent policy namespace.'
        output_id:
          maxLength: 255
          type:
            - 'null'
            - string
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        policy_id:
          maxLength: 255
          type:
            - 'null'
            - string
          description: Deprecated. Use policy_ids instead.
          deprecated: true
        policy_ids:
          maxItems: 1000
          type: array
          items:
            maxLength: 255
            type: string
          description: IDs of the agent policies that the package policy will be added to.
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy belongs to an agentless agent policy. Deprecated in favor of the Fleet managed integrations API.
          deprecated: true
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          type: object
          additionalProperties:
            anyOf:
              - maxLength: 10000
                type: string
              - type: number
              - type: boolean
              - maxItems: 100
                type: array
                items:
                  maxLength: 10000
                  type: string
              - maxItems: 100
                type: array
                items:
                  type: number
              - required:
                  - id
                  - isSecretRef
                type: object
                properties:
                  id:
                    maxLength: 255
                    type: string
                  isSecretRef:
                    type: boolean
                additionalProperties: false
            default: 'null'
          description: Input/stream level variable. Refer to the integration documentation for more information.
      additionalProperties: false
    Kibana_HTTP_APIs_simplified_package_policy_input_deprecation_info:
      title: simplified_package_policy_input_deprecation_info
      required:
        - description
      type: object
      properties:
        description:
          maxLength: 4096
          type: string
        replaced_by:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
        since:
          maxLength: 50
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_simplified_package_policy_stream_deprecation_info:
      title: simplified_package_policy_stream_deprecation_info
      required:
        - description
      type: object
      properties:
        description:
          maxLength: 4096
          type: string
        replaced_by:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
        since:
          maxLength: 50
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_slo-alerts-embeddable:
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        drilldowns:
          maxItems: 100
          type: array
          items:
            anyOf:
              - title: url_drilldown
                allOf:
                  - required:
                      - url
                    type: object
                    properties:
                      encode_url:
                        type: boolean
                        description: 'When true, URL is escaped using percent encoding'
                        default: true
                      open_in_new_tab:
                        type: boolean
                        default: true
                      url:
                        type: string
                        description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                    additionalProperties: false
                  - required:
                      - label
                      - trigger
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                      trigger:
                        anyOf:
                          - enum:
                              - on_open_panel_menu
                            type: string
                      type:
                        enum:
                          - url_drilldown
                        type: string
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        slos:
          maxItems: 100
          type: array
          items:
            required:
              - slo_id
            type: object
            properties:
              slo_id:
                maxLength: 64
                type: string
                description: SLO ID
              slo_instance_id:
                maxLength: 512
                type: string
                description: SLO instance ID
                default: '*'
            additionalProperties: false
          description: List of SLOs to display alerts for
          default: [ ]
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: SLO Alerts embeddable schema
    Kibana_HTTP_APIs_slo-burn-rate-embeddable:
      required:
        - slo_id
        - duration
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        drilldowns:
          maxItems: 100
          type: array
          items:
            anyOf:
              - title: url_drilldown
                allOf:
                  - required:
                      - url
                    type: object
                    properties:
                      encode_url:
                        type: boolean
                        description: 'When true, URL is escaped using percent encoding'
                        default: true
                      open_in_new_tab:
                        type: boolean
                        default: true
                      url:
                        type: string
                        description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                    additionalProperties: false
                  - required:
                      - label
                      - trigger
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                      trigger:
                        anyOf:
                          - enum:
                              - on_open_panel_menu
                            type: string
                      type:
                        enum:
                          - url_drilldown
                        type: string
        duration:
          maxLength: 32
          type: string
          description: 'Duration for the burn rate chart in the format [value][unit], e.g. 5m, 3h, or 6d'
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        slo_id:
          maxLength: 64
          type: string
          description: The ID of the SLO to display the burn rate for
        slo_instance_id:
          maxLength: 512
          type: string
          description: ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances).
          default: '*'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: SLO Burn Rate embeddable schema
    Kibana_HTTP_APIs_slo-error-budget-embeddable:
      required:
        - slo_id
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        drilldowns:
          maxItems: 100
          type: array
          items:
            anyOf:
              - title: url_drilldown
                allOf:
                  - required:
                      - url
                    type: object
                    properties:
                      encode_url:
                        type: boolean
                        description: 'When true, URL is escaped using percent encoding'
                        default: true
                      open_in_new_tab:
                        type: boolean
                        default: true
                      url:
                        type: string
                        description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                    additionalProperties: false
                  - required:
                      - label
                      - trigger
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                      trigger:
                        anyOf:
                          - enum:
                              - on_open_panel_menu
                            type: string
                      type:
                        enum:
                          - url_drilldown
                        type: string
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        slo_id:
          maxLength: 64
          type: string
          description: The ID of the SLO to display the error budget for
        slo_instance_id:
          maxLength: 512
          type: string
          description: ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances).
          default: '*'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: SLO Error Budget embeddable schema
    Kibana_HTTP_APIs_slo-group-overview-embeddable:
      required:
        - overview_mode
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        drilldowns:
          maxItems: 100
          type: array
          items:
            anyOf:
              - title: url_drilldown
                allOf:
                  - required:
                      - url
                    type: object
                    properties:
                      encode_url:
                        type: boolean
                        description: 'When true, URL is escaped using percent encoding'
                        default: true
                      open_in_new_tab:
                        type: boolean
                        default: true
                      url:
                        type: string
                        description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                    additionalProperties: false
                  - required:
                      - label
                      - trigger
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                      trigger:
                        anyOf:
                          - enum:
                              - on_open_panel_menu
                            type: string
                      type:
                        enum:
                          - url_drilldown
                        type: string
        group_filters:
          type: object
          properties:
            filters:
              maxItems: 500
              type: array
              items:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema'
            group_by:
              anyOf:
                - enum:
                    - slo.tags
                  type: string
                - enum:
                    - status
                  type: string
                - enum:
                    - slo.indicator.type
                  type: string
                - enum:
                    - _index
                  type: string
              default: status
            groups:
              maxItems: 100
              type: array
              items:
                maxLength: 256
                type: string
            kql_query:
              maxLength: 2048
              type: string
          additionalProperties: false
          default:
            group_by: status
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        overview_mode:
          enum:
            - groups
          type: string
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: SLO Group Overview embeddable schema
    Kibana_HTTP_APIs_slo-rules-burnrate-create-rule-body-alerting:
      title: SLO burn rate
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: SLO Burn Rate Rule Params
          required:
            - sloId
            - windows
          type: object
          properties:
            dependencies:
              type: array
              items:
                required:
                  - ruleId
                  - actionGroupsToSuppressOn
                type: object
                properties:
                  actionGroupsToSuppressOn:
                    type: array
                    items:
                      type: string
                  ruleId:
                    type: string
                additionalProperties: false
            sloId:
              type: string
            windows:
              type: array
              items:
                required:
                  - id
                  - burnRateThreshold
                  - longWindow
                  - shortWindow
                  - actionGroup
                type: object
                properties:
                  actionGroup:
                    type: string
                  burnRateThreshold:
                    type: number
                  id:
                    type: string
                  longWindow:
                    required:
                      - value
                      - unit
                    type: object
                    properties:
                      unit:
                        type: string
                      value:
                        type: number
                    additionalProperties: false
                  maxBurnRateThreshold:
                    type:
                      - 'null'
                      - number
                    default: 'null'
                  shortWindow:
                    required:
                      - value
                      - unit
                    type: object
                    properties:
                      unit:
                        type: string
                      value:
                        type: number
                    additionalProperties: false
                additionalProperties: false
          additionalProperties: false
          description: The parameters for the slo burn rate rule. These parameters are appropriate when `rule_type_id` is `slo.rules.burnRate`.
        rule_type_id:
          enum:
            - slo.rules.burnRate
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_slo-single-overview-embeddable:
      required:
        - slo_id
        - overview_mode
      type: object
      properties:
        description:
          type: string
          description: A short description of the panel.
        drilldowns:
          maxItems: 100
          type: array
          items:
            anyOf:
              - title: url_drilldown
                allOf:
                  - required:
                      - url
                    type: object
                    properties:
                      encode_url:
                        type: boolean
                        description: 'When true, URL is escaped using percent encoding'
                        default: true
                      open_in_new_tab:
                        type: boolean
                        default: true
                      url:
                        type: string
                        description: Templated Url. Variables documented at https://www.elastic.co/docs/explore-analyze/dashboards/drilldowns#url-template-variable
                    additionalProperties: false
                  - required:
                      - label
                      - trigger
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                      trigger:
                        anyOf:
                          - enum:
                              - on_open_panel_menu
                            type: string
                      type:
                        enum:
                          - url_drilldown
                        type: string
        hide_border:
          type: boolean
          description: 'When true, the panel border is hidden. Defaults to false.'
        hide_title:
          type: boolean
          description: 'When true, the panel title is hidden. Defaults to false.'
        overview_mode:
          enum:
            - single
          type: string
        remote_name:
          maxLength: 256
          type: string
          description: The name of the remote SLO
        slo_id:
          maxLength: 64
          type: string
          description: The ID of the SLO
        slo_instance_id:
          maxLength: 512
          type: string
          description: ID of the SLO instance. Set when the SLO uses group_by; identifies which instance to show. Defaults to * (all instances).
          default: '*'
        title:
          type: string
          description: The panel title.
      additionalProperties: false
      description: SLO Single Overview embeddable schema
    Kibana_HTTP_APIs_StreamlangConditionBlock:
      required:
        - condition
      type: object
      properties:
        condition:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_ConditionWithSteps'
        customIdentifier:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_StreamlangStep:
      anyOf:
        - anyOf:
            - required:
                - action
                - from
                - patterns
              type: object
              properties:
                action:
                  enum:
                    - grok
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Source field to parse with grok patterns
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                pattern_definitions:
                  type: object
                  additionalProperties:
                    type: string
                patterns:
                  minItems: 1
                  type: array
                  items:
                    minLength: 1
                    type: string
                    description: A non-empty string.
                  description: Grok patterns applied in order to extract fields
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Grok processor - Extract fields from text using grok patterns
            - required:
                - action
                - from
                - pattern
              type: object
              properties:
                action:
                  enum:
                    - dissect
                  type: string
                append_separator:
                  minLength: 1
                  type: string
                  description: Separator inserted when target fields are concatenated
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Source field to parse with dissect pattern
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                pattern:
                  minLength: 1
                  type: string
                  description: Dissect pattern describing field boundaries
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: 'Dissect processor - Extract fields from text using a lightweight, delimiter-based parser'
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - uri_parts
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Source field holding the URI string to parse
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                keep_original:
                  type: boolean
                  description: 'If true (default), preserve the original URI string alongside the extracted parts'
                remove_if_successful:
                  type: boolean
                  description: 'If true, remove the source field after a successful parse. Source field is kept on failure.'
                to:
                  minLength: 1
                  type: string
                  description: 'Target field / column prefix for the extracted URI components (defaults to "url"). May equal `from` — the canonical ECS shape parses the `url` field in place. Note: combining `to === from` with `remove_if_successful: true` nulls the parsed object after writing it.'
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: 'URI parts processor - Parse a URI into components (scheme, domain, port, path, query, fragment, ...)'
            - required:
                - action
                - from
                - formats
              type: object
              properties:
                action:
                  enum:
                    - date
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                formats:
                  type: array
                  items:
                    minLength: 1
                    type: string
                    description: A non-empty string.
                  description: 'Accepted input date formats, tried in order'
                from:
                  minLength: 1
                  type: string
                  description: Source field containing the date/time text
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                locale:
                  minLength: 1
                  type: string
                  description: Optional locale for date parsing
                output_format:
                  minLength: 1
                  type: string
                  description: Optional output format for storing the parsed date as text
                timezone:
                  minLength: 1
                  type: string
                  description: Optional timezone for date parsing
                to:
                  minLength: 1
                  type: string
                  description: Target field for the parsed date (defaults to source)
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Date processor - Parse dates from strings using one or more expected formats
            - required:
                - action
              type: object
              properties:
                action:
                  enum:
                    - drop_document
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - expression
                - to
              type: object
              properties:
                action:
                  enum:
                    - math
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                expression:
                  minLength: 1
                  type: string
                  description: A non-empty string.
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
                - to
              type: object
              properties:
                action:
                  enum:
                    - rename
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Existing source field to rename or move
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip when source field is missing
                override:
                  type: boolean
                  description: Allow overwriting the target field if it already exists
                to:
                  minLength: 1
                  type: string
                  description: New field name or destination path
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Rename processor - Change a field name and optionally its location
            - required:
                - action
                - to
              type: object
              properties:
                action:
                  enum:
                    - set
                  type: string
                copy_from:
                  minLength: 1
                  type: string
                  description: Copy value from another field instead of providing a literal
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                override:
                  type: boolean
                  description: Allow overwriting an existing target field
                to:
                  minLength: 1
                  type: string
                  description: Target field to set or create
                value:
                  description: Literal value to assign to the target field
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Set processor - Assign a literal or copied value to a field (mutually exclusive inputs)
            - required:
                - action
                - to
                - value
              type: object
              properties:
                action:
                  enum:
                    - append
                  type: string
                allow_duplicates:
                  type: boolean
                  description: 'If true, do not deduplicate appended values'
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                to:
                  minLength: 1
                  type: string
                  description: Array field to append values to
                value:
                  minItems: 1
                  type: array
                  items: { }
                  description: 'Values to append (must be literal, no templates)'
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Append processor - Append one or more values to an existing or new array field
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - remove_by_prefix
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Field to remove along with all its nested fields
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
              additionalProperties: false
              description: Remove by prefix processor - Remove a field and all nested fields matching the prefix
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - remove
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Field to remove from the document
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Remove processor - Delete one or more fields from the document
            - required:
                - action
                - from
                - pattern
                - replacement
              type: object
              properties:
                action:
                  enum:
                    - replace
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                pattern:
                  minLength: 1
                  type: string
                replacement:
                  type: string
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
                - patterns
              type: object
              properties:
                action:
                  enum:
                    - redact
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Source field to redact sensitive data from
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing (defaults to true)
                pattern_definitions:
                  type: object
                  additionalProperties:
                    type: string
                  description: Custom pattern definitions to use in the patterns
                patterns:
                  minItems: 1
                  type: array
                  items:
                    minLength: 1
                    type: string
                    description: A non-empty string.
                  description: 'Grok patterns to match sensitive data (for example, "%{IP:client}", "%{EMAILADDRESS:email}")'
                prefix:
                  type: string
                  description: Prefix to prepend to the redacted pattern name (defaults to "<")
                suffix:
                  type: string
                  description: Suffix to append to the redacted pattern name (defaults to ">")
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Redact processor - Mask sensitive data using Grok patterns
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - uppercase
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - lowercase
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - trim
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
                - delimiter
                - to
              type: object
              properties:
                action:
                  enum:
                    - join
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                delimiter:
                  type: string
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minItems: 1
                  type: array
                  items:
                    minLength: 1
                    type: string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
                - separator
              type: object
              properties:
                action:
                  enum:
                    - split
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Source field to split into an array
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                preserve_trailing:
                  type: boolean
                  description: Preserve empty trailing fields in the split result
                separator:
                  minLength: 1
                  type: string
                  description: Regex separator used to split the field value into an array
                to:
                  minLength: 1
                  type: string
                  description: Target field for the split array (defaults to source)
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Split processor - Split a field value into an array using a separator
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - sort
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Array field to sort
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                order:
                  enum:
                    - asc
                    - desc
                  type: string
                  description: Sort order - "asc" (ascending) or "desc" (descending). Defaults to "asc"
                to:
                  minLength: 1
                  type: string
                  description: Target field for the sorted array (defaults to source)
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
                - type
              type: object
              properties:
                action:
                  enum:
                    - convert
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minLength: 1
                  type: string
                  description: Source field to convert to a different data type
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                to:
                  minLength: 1
                  type: string
                  description: Target field for the converted value (defaults to source)
                type:
                  enum:
                    - integer
                    - long
                    - double
                    - boolean
                    - string
                  type: string
                  description: 'Target data type: integer, long, double, boolean, or string'
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: 'Convert processor - Change the data type of a field value (integer, long, double, boolean, or string)'
            - required:
                - action
                - from
                - to
              type: object
              properties:
                action:
                  enum:
                    - concat
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                from:
                  minItems: 1
                  type: array
                  items:
                    anyOf:
                      - required:
                          - type
                          - value
                        type: object
                        properties:
                          type:
                            enum:
                              - field
                            type: string
                          value:
                            minLength: 1
                            type: string
                      - required:
                          - type
                          - value
                        type: object
                        properties:
                          type:
                            enum:
                              - literal
                            type: string
                          value:
                            type: string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - allOf:
                - required:
                    - action
                    - source_ip
                    - destination_ip
                  type: object
                  properties:
                    action:
                      enum:
                        - network_direction
                      type: string
                    customIdentifier:
                      minLength: 1
                      type: string
                      description: Custom identifier to correlate this processor across outputs
                    description:
                      type: string
                      description: Human-readable notes about this processor step
                    destination_ip:
                      minLength: 1
                      type: string
                    ignore_failure:
                      type: boolean
                      description: Continue pipeline execution if this processor fails
                    ignore_missing:
                      type: boolean
                    source_ip:
                      minLength: 1
                      type: string
                    target_field:
                      minLength: 1
                      type: string
                    where:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                  additionalProperties: false
                - anyOf:
                    - required:
                        - internal_networks
                      type: object
                      properties:
                        internal_networks:
                          type: array
                          items:
                            type: string
                      additionalProperties: false
                    - required:
                        - internal_networks_field
                      type: object
                      properties:
                        internal_networks_field:
                          minLength: 1
                          type: string
                      additionalProperties: false
            - required:
                - action
                - field
                - extractions
              type: object
              properties:
                action:
                  enum:
                    - json_extract
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                extractions:
                  minItems: 1
                  type: array
                  items:
                    required:
                      - selector
                      - target_field
                    type: object
                    properties:
                      selector:
                        minLength: 1
                        type: string
                        description: 'JSONPath-like selector to extract value (e.g., "user.id", "$.metadata.client.ip", "items[0].name")'
                      target_field:
                        minLength: 1
                        type: string
                        description: Target field to store the extracted value
                      type:
                        enum:
                          - keyword
                          - integer
                          - long
                          - double
                          - boolean
                        type: string
                        description: Data type for the extracted value. Defaults to "keyword". Ensures consistent types across transpilers.
                    description: A single extraction specification
                  description: List of extraction specifications
                field:
                  minLength: 1
                  type: string
                  description: Source field containing the JSON string to parse
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: JsonExtract processor - Extract values from JSON strings using JSONPath-like selectors
            - required:
                - action
                - policy_name
                - to
              type: object
              properties:
                action:
                  enum:
                    - enrich
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                override:
                  type: boolean
                policy_name:
                  minLength: 1
                  type: string
                  description: A non-empty string.
                to:
                  minLength: 1
                  type: string
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
            - required:
                - action
                - from
              type: object
              properties:
                action:
                  enum:
                    - user_agent
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                extract_device_type:
                  type: boolean
                  description: Extracts device type from the user agent string
                from:
                  minLength: 1
                  type: string
                  description: The field containing the user agent string
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when source field is missing
                properties:
                  type: array
                  items:
                    enum:
                      - name
                      - os
                      - device
                      - original
                      - version
                    type: string
                  description: Specific properties to extract (defaults to all)
                regex_file:
                  minLength: 1
                  type: string
                  description: Custom regex file name containing the regular expressions for parsing the user agent string
                to:
                  minLength: 1
                  type: string
                  description: The field that will be filled with the user agent details
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: 'User agent processor - Extract browser, OS, and device details from a user agent string'
            - required:
                - action
                - expression
                - prefix
              type: object
              properties:
                action:
                  enum:
                    - registered_domain
                  type: string
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                expression:
                  minLength: 1
                  type: string
                  description: The string expression containing the FQDN to parse
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                ignore_missing:
                  type: boolean
                  description: Skip processing when expression field is missing
                prefix:
                  minLength: 1
                  type: string
                  description: The prefix for the output columns. The extracted parts are available as prefix.part_name
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: 'Registered domain processor - extracts domain, registered_domain, top_level_domain, subdomain from a FQDN'
            - required:
                - action
                - processors
              type: object
              properties:
                action:
                  enum:
                    - manual_ingest_pipeline
                  type: string
                  description: Manual ingest pipeline - executes raw Elasticsearch ingest processors
                customIdentifier:
                  minLength: 1
                  type: string
                  description: Custom identifier to correlate this processor across outputs
                description:
                  type: string
                  description: Human-readable notes about this processor step
                ignore_failure:
                  type: boolean
                  description: Continue pipeline execution if this processor fails
                on_failure:
                  type: array
                  items:
                    type: object
                    additionalProperties: { }
                  description: Fallback processors to run when a processor fails
                processors:
                  type: array
                  items:
                    type: object
                    additionalProperties: { }
                  description: List of raw Elasticsearch ingest processors to run
                tag:
                  type: string
                  description: Optional ingest processor tag for Elasticsearch
                where:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
              additionalProperties: false
              description: Manual ingest pipeline wrapper around native Elasticsearch processors
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangConditionBlock'
    Kibana_HTTP_APIs_StreamUpsertRequest:
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_WiredStreamUpsertRequest'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_ClassicStreamUpsertRequest'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_QueryStreamUpsertRequest'
    Kibana_HTTP_APIs_tagcloudLibItemNoESQL:
      title: Tag Cloud Chart (library)
      required:
        - type
        - data_source
        - metric
        - tag_by
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          anyOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTagcloudStyling'
        tag_by:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                color:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              additionalProperties: false
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - tag_cloud
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_transform-health-create-rule-body-alerting:
      title: Transform health
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Transform Health Rule Params
          required:
            - includeTransforms
          type: object
          properties:
            excludeTransforms:
              type:
                - 'null'
                - array
              items:
                type: string
              default: 'null'
            includeTransforms:
              type: array
              items:
                type: string
            testsConfig:
              type:
                - 'null'
                - object
              properties:
                errorMessages:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: false
                  additionalProperties: false
                  default: 'null'
                healthCheck:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: true
                  additionalProperties: false
                  default: 'null'
                notStarted:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: true
                  additionalProperties: false
                  default: 'null'
              additionalProperties: false
              default: 'null'
          additionalProperties: false
          description: The parameters for the transform health rule. These parameters are appropriate when `rule_type_id` is `transform_health`.
        rule_type_id:
          enum:
            - transform_health
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_treemapLibItemNoESQL:
      title: Treemap Chart (library)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metric configurations (minimum 1)
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - treemap
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_update_agent_policy_request_body:
      title: update_agent_policy_request_body
      required:
        - name
        - namespace
      type: object
      properties:
        advanced_settings:
          type: object
          properties:
            agent_download_target_directory: { }
            agent_download_timeout: { }
            agent_features_disable_policy_change_acks_enabled: { }
            agent_features_include_tags_in_events_enabled: { }
            agent_internal: { }
            agent_limits_go_max_procs: { }
            agent_logging_files_interval: { }
            agent_logging_files_keepfiles: { }
            agent_logging_files_rotateeverybytes: { }
            agent_logging_level: { }
            agent_logging_metrics_period: { }
            agent_logging_to_files: { }
            agent_monitoring_runtime_experimental: { }
          additionalProperties: false
        agent_features:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - enabled
            type: object
            properties:
              enabled:
                type: boolean
              name:
                type: string
            additionalProperties: false
        agentless:
          type: object
          properties:
            cloud_connectors:
              required:
                - enabled
              type: object
              properties:
                enabled:
                  type: boolean
                target_csp:
                  enum:
                    - aws
                    - azure
                    - gcp
                  type: string
              additionalProperties: false
            cluster_id:
              type: string
            resources:
              type: object
              properties:
                requests:
                  type: object
                  properties:
                    cpu:
                      type: string
                    memory:
                      type: string
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        bumpRevision:
          type: boolean
        data_output_id:
          type:
            - 'null'
            - string
        description:
          type: string
        download_source_id:
          type:
            - 'null'
            - string
          description: Use `download_source_ids` instead
          deprecated: true
        download_source_ids:
          maxItems: 3
          type: array
          items:
            maxLength: 500
            type: string
            description: 'A download source ID, or the reserved value ''default'' to dynamically reference whichever source is currently set as default.'
        fleet_server_host_id:
          type:
            - 'null'
            - string
        force:
          type: boolean
        global_data_tags:
          maxItems: 100
          type: array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
              value:
                type:
                  - number
                  - string
            additionalProperties: false
          description: User defined data tags that are added to all of the inputs. The values can be strings or numbers.
        has_agent_version_conditions:
          type: boolean
        has_fleet_server:
          type: boolean
        id:
          type: string
        inactivity_timeout:
          minimum: 0
          type: number
          default: 1209600
        is_default:
          type: boolean
        is_default_fleet_server:
          type: boolean
        is_managed:
          type: boolean
        is_protected:
          type: boolean
        is_verifier:
          type: boolean
        keep_monitoring_alive:
          type:
            - 'null'
            - boolean
          description: 'When set to true, monitoring will be enabled but logs/metrics collection will be disabled'
        min_agent_version:
          type:
            - 'null'
            - string
        monitoring_diagnostics:
          type: object
          properties:
            limit:
              type: object
              properties:
                burst:
                  type: number
                interval:
                  type: string
              additionalProperties: false
            uploader:
              type: object
              properties:
                init_dur:
                  type: string
                max_dur:
                  type: string
                max_retries:
                  type: number
              additionalProperties: false
          additionalProperties: false
        monitoring_enabled:
          maxItems: 3
          type: array
          items:
            enum:
              - logs
              - metrics
              - traces
            type: string
        monitoring_http:
          type: object
          properties:
            buffer:
              type: object
              properties:
                enabled:
                  type: boolean
                  default: false
              additionalProperties: false
            enabled:
              type: boolean
            host:
              type: string
            port:
              maximum: 65353
              minimum: 0
              type: number
          additionalProperties: false
        monitoring_output_id:
          type:
            - 'null'
            - string
        monitoring_pprof_enabled:
          type: boolean
        name:
          minLength: 1
          type: string
        namespace:
          minLength: 1
          type: string
        overrides:
          type:
            - 'null'
            - object
          additionalProperties: { }
          description: Override settings that are defined in the agent policy. Input settings cannot be overridden. The override option should be used only in unusual circumstances and not as a routine procedure.
        package_agent_version_conditions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - title
              - version_condition
            type: object
            properties:
              name:
                type: string
              title:
                type: string
              version_condition:
                type: string
            additionalProperties: false
        required_versions:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - version
              - percentage
            type: object
            properties:
              percentage:
                maximum: 100
                minimum: 0
                type: number
                description: Target percentage of agents to auto upgrade
              version:
                type: string
                description: Target version for automatic agent upgrade
            additionalProperties: false
        space_ids:
          maxItems: 100
          type: array
          items:
            type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the agent policy supports agentless integrations. Deprecated in favor of the Fleet managed integrations API.
          deprecated: true
        unenroll_timeout:
          minimum: 0
          type: number
      additionalProperties: false
    Kibana_HTTP_APIs_update_connector:
      title: update_connector
      required:
        - name
      type: object
      properties:
        name:
          type: string
          description: The display name for the connector.
        config:
          oneOf:
            - $ref: '#/components/schemas/bedrock_config'
            - $ref: '#/components/schemas/crowdstrike_config'
            - $ref: '#/components/schemas/d3security_config'
            - $ref: '#/components/schemas/email_config'
            - $ref: '#/components/schemas/gemini_config'
            - $ref: '#/components/schemas/resilient_config'
            - $ref: '#/components/schemas/index_config'
            - $ref: '#/components/schemas/jira_config'
            - $ref: '#/components/schemas/defender_config'
            - $ref: '#/components/schemas/genai_azure_config'
            - $ref: '#/components/schemas/genai_openai_config'
            - $ref: '#/components/schemas/opsgenie_config'
            - $ref: '#/components/schemas/pagerduty_config'
            - $ref: '#/components/schemas/sentinelone_config'
            - $ref: '#/components/schemas/servicenow_config'
            - $ref: '#/components/schemas/servicenow_itom_config'
            - $ref: '#/components/schemas/slack_api_config'
            - $ref: '#/components/schemas/swimlane_config'
            - $ref: '#/components/schemas/thehive_config'
            - $ref: '#/components/schemas/tines_config'
            - $ref: '#/components/schemas/torq_config'
            - $ref: '#/components/schemas/webhook_config'
            - $ref: '#/components/schemas/cases_webhook_config'
            - $ref: '#/components/schemas/xmatters_config'
          additionalProperties: { }
          description: The connector configuration details.
        secrets:
          oneOf:
            - $ref: '#/components/schemas/bedrock_secrets'
            - $ref: '#/components/schemas/crowdstrike_secrets'
            - $ref: '#/components/schemas/d3security_secrets'
            - $ref: '#/components/schemas/email_secrets'
            - $ref: '#/components/schemas/gemini_secrets'
            - $ref: '#/components/schemas/resilient_secrets'
            - $ref: '#/components/schemas/jira_secrets'
            - $ref: '#/components/schemas/teams_secrets'
            - $ref: '#/components/schemas/genai_secrets'
            - $ref: '#/components/schemas/opsgenie_secrets'
            - $ref: '#/components/schemas/pagerduty_secrets'
            - $ref: '#/components/schemas/sentinelone_secrets'
            - $ref: '#/components/schemas/servicenow_secrets'
            - $ref: '#/components/schemas/slack_api_secrets'
            - $ref: '#/components/schemas/swimlane_secrets'
            - $ref: '#/components/schemas/thehive_secrets'
            - $ref: '#/components/schemas/tines_secrets'
            - $ref: '#/components/schemas/torq_secrets'
            - $ref: '#/components/schemas/webhook_secrets'
            - $ref: '#/components/schemas/cases_webhook_secrets'
            - $ref: '#/components/schemas/xmatters_secrets'
          additionalProperties: { }
      additionalProperties: false
    Kibana_HTTP_APIs_update_maintenance_window:
      title: update_maintenance_window
      type: object
      properties:
        enabled:
          type: boolean
          description: Whether the current maintenance window is enabled. Disabled maintenance windows do not suppress notifications.
        schedule:
          required:
            - custom
          type: object
          properties:
            custom:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_schedule_request'
          additionalProperties: false
        scope:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_maintenance_window_scope'
        title:
          type: string
          description: 'The name of the maintenance window. While this name does not have to be unique, a distinctive name can help you identify a specific maintenance window.'
      additionalProperties: false
    Kibana_HTTP_APIs_update_output_elasticsearch:
      title: update_output_elasticsearch
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            format: uri
        id:
          type: string
        is_default:
          type: boolean
        is_default_monitoring:
          type: boolean
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        preset:
          enum:
            - balanced
            - custom
            - throughput
            - scale
            - latency
          type: string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        type:
          enum:
            - elasticsearch
          type: string
        write_to_logs_streams:
          type:
            - 'null'
            - boolean
      additionalProperties: false
    Kibana_HTTP_APIs_update_output_kafka:
      title: update_output_kafka
      required:
        - name
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        auth_type:
          enum:
            - none
            - user_pass
            - ssl
            - kerberos
          type: string
        broker_timeout:
          type: number
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        client_id:
          type: string
        compression:
          enum:
            - gzip
            - snappy
            - lz4
            - none
          type: string
        compression_level:
          type:
            - 'null'
            - number
        config_yaml:
          type:
            - 'null'
            - string
        connection_type:
          enum:
            - plaintext
            - encryption
          type: string
        hash:
          type: object
          properties:
            hash:
              type: string
            random:
              type: boolean
          additionalProperties: false
        headers:
          maxItems: 100
          type: array
          items:
            required:
              - key
              - value
            type: object
            properties:
              key:
                type: string
              value:
                type: string
            additionalProperties: false
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
          default: false
        is_default_monitoring:
          type: boolean
          default: false
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        key:
          type: string
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        partition:
          enum:
            - random
            - round_robin
            - hash
          type: string
        password:
          type:
            - 'null'
            - string
        proxy_id:
          type:
            - 'null'
            - string
          description: Kafka outputs do not support proxy configuration. This field is accepted for backwards compatibility but is ignored — it is cleared to null on save and has no effect on the compiled agent policy.
          deprecated: true
        random:
          type: object
          properties:
            group_events:
              type: number
          additionalProperties: false
        required_acks:
          enum:
            - 1
            - 0
            - -1
          type: integer
        round_robin:
          type: object
          properties:
            group_events:
              type: number
          additionalProperties: false
        sasl:
          type:
            - 'null'
            - object
          properties:
            mechanism:
              enum:
                - PLAIN
                - SCRAM-SHA-256
                - SCRAM-SHA-512
              type: string
          additionalProperties: false
        secrets:
          type: object
          properties:
            password:
              anyOf:
                - required:
                    - id
                  type: object
                  properties:
                    hash:
                      type: string
                    id:
                      type: string
                  additionalProperties: false
                - type: string
            ssl:
              required:
                - key
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        timeout:
          type: number
        topic:
          type: string
        type:
          enum:
            - kafka
          type: string
        username:
          type:
            - 'null'
            - string
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_update_output_logstash:
      title: update_output_logstash
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
        is_default_monitoring:
          type: boolean
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        type:
          enum:
            - logstash
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_update_output_otlp:
      title: update_output_otlp
      required:
        - otlp_exporter
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        id:
          type: string
        is_default:
          type: boolean
        is_default_monitoring:
          type: boolean
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        name:
          type: string
        otlp_exporter:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter'
          discriminator:
            propertyName: protocol
            mapping:
              grpc: '#/components/schemas/Kibana_HTTP_APIs_otlp_grpc_exporter'
              http/protobuf: '#/components/schemas/Kibana_HTTP_APIs_otlp_http_exporter'
        secrets:
          type: object
          properties:
            otlp_exporter:
              type: object
              properties:
                tls:
                  type: object
                  properties:
                    key_pem:
                      anyOf:
                        - required:
                            - id
                          type: object
                          properties:
                            hash:
                              type: string
                            id:
                              type: string
                          additionalProperties: false
                        - type: string
                    tpm:
                      type: object
                      properties:
                        auth:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                hash:
                                  type: string
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                        owner_auth:
                          anyOf:
                            - required:
                                - id
                              type: object
                              properties:
                                hash:
                                  type: string
                                id:
                                  type: string
                              additionalProperties: false
                            - type: string
                      additionalProperties: false
                  additionalProperties: false
              additionalProperties: false
          additionalProperties: false
        type:
          enum:
            - otlp
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_update_output_remote_elasticsearch:
      title: update_output_remote_elasticsearch
      type: object
      properties:
        allow_edit:
          maxItems: 1000
          type: array
          items:
            type: string
        ca_sha256:
          type:
            - 'null'
            - string
        ca_trusted_fingerprint:
          type:
            - 'null'
            - string
        config_yaml:
          type:
            - 'null'
            - string
        hosts:
          maxItems: 100
          minItems: 1
          type: array
          items:
            type: string
            format: uri
        id:
          type: string
        is_default:
          type: boolean
        is_default_monitoring:
          type: boolean
        is_internal:
          type: boolean
        is_preconfigured:
          type: boolean
        kibana_api_key:
          type:
            - 'null'
            - string
        kibana_url:
          type:
            - 'null'
            - string
        name:
          type: string
        otel_disable_beatsauth:
          type:
            - 'null'
            - boolean
        otel_exporter_config_yaml:
          type:
            - 'null'
            - string
        preset:
          enum:
            - balanced
            - custom
            - throughput
            - scale
            - latency
          type: string
        proxy_id:
          type:
            - 'null'
            - string
        secrets:
          type: object
          properties:
            service_token:
              anyOf:
                - required:
                    - id
                  type: object
                  properties:
                    hash:
                      type: string
                    id:
                      type: string
                  additionalProperties: false
                - type: string
            ssl:
              type: object
              properties:
                key:
                  anyOf:
                    - required:
                        - id
                      type: object
                      properties:
                        hash:
                          type: string
                        id:
                          type: string
                      additionalProperties: false
                    - type: string
              additionalProperties: false
          additionalProperties: false
        service_token:
          type:
            - 'null'
            - string
        shipper:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_shipper'
        ssl:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_output_ssl'
        sync_integrations:
          type: boolean
        sync_uninstalled_integrations:
          type: boolean
        type:
          enum:
            - remote_elasticsearch
          type: string
        write_to_logs_streams:
          type:
            - 'null'
            - boolean
      additionalProperties: false
    Kibana_HTTP_APIs_update_package_policy_request:
      title: update_package_policy_request
      type: object
      properties:
        additional_datastreams_permissions:
          maxItems: 1000
          type:
            - 'null'
            - array
          items:
            type: string
          description: Additional data stream permissions that will be added to the agent policy.
        cloud_connector_id:
          type:
            - 'null'
            - string
          description: ID of the cloud connector associated with this package policy.
        cloud_connector_name:
          maxLength: 255
          minLength: 1
          type:
            - 'null'
            - string
          description: Transient field for cloud connector name during creation.
        condition:
          maxLength: 10000
          type:
            - 'null'
            - string
          description: Agent condition expression to evaluate whether to apply this integration to its inputs.
        description:
          type: string
          description: Package policy description
        enabled:
          type: boolean
        force:
          type: boolean
        global_data_tags:
          maxItems: 100
          type:
            - 'null'
            - array
          items:
            required:
              - name
              - value
            type: object
            properties:
              name:
                type: string
                description: The name of the custom field. Cannot contain spaces.
              value:
                type:
                  - number
                  - string
                description: The value of the custom field.
            additionalProperties: false
        inputs:
          maxItems: 1000
          type: array
          items:
            required:
              - type
              - enabled
            type: object
            properties:
              condition:
                maxLength: 10000
                type:
                  - 'null'
                  - string
                description: Agent condition expression to evaluate whether to apply this input.
              config:
                type: object
                additionalProperties:
                  required:
                    - value
                  type: object
                  properties:
                    frozen:
                      type: boolean
                    type:
                      type: string
                    value: { }
                  additionalProperties: false
                description: Package variable (see integration documentation for more information)
              deprecated:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_input_deprecation_info'
              enabled:
                type: boolean
              id:
                type: string
              keep_enabled:
                type: boolean
              migrate_from:
                type: string
              name:
                type: string
              policy_template:
                type: string
              streams:
                maxItems: 1000
                type: array
                items:
                  required:
                    - enabled
                    - data_stream
                    - compiled_stream
                  type: object
                  properties:
                    compiled_stream: { }
                    condition:
                      maxLength: 10000
                      type:
                        - 'null'
                        - string
                      description: Agent condition expression to evaluate whether to apply this stream.
                    config:
                      type: object
                      additionalProperties:
                        required:
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            type: string
                          value: { }
                        additionalProperties: false
                      description: Package variable (see integration documentation for more information)
                    data_stream:
                      required:
                        - dataset
                      type: object
                      properties:
                        dataset:
                          type: string
                        elasticsearch:
                          type: object
                          properties:
                            dynamic_dataset:
                              type: boolean
                            dynamic_namespace:
                              type: boolean
                            privileges:
                              type: object
                              properties:
                                indices:
                                  maxItems: 100
                                  type: array
                                  items:
                                    type: string
                              additionalProperties: false
                          additionalProperties: false
                        type:
                          type: string
                      additionalProperties: false
                    deprecated:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_stream_deprecation_info'
                    enabled:
                      type: boolean
                    id:
                      type: string
                    keep_enabled:
                      type: boolean
                    migrate_from:
                      type: string
                    release:
                      enum:
                        - ga
                        - beta
                        - experimental
                      type: string
                    var_group_selections:
                      type: object
                      additionalProperties:
                        maxLength: 1024
                        type: string
                      description: Variable group selections. Maps var_group name to the selected option name within that group.
                    vars:
                      type: object
                      additionalProperties:
                        required:
                          - value
                        type: object
                        properties:
                          frozen:
                            type: boolean
                          type:
                            type: string
                          value: { }
                        additionalProperties: false
                      description: Package variable (see integration documentation for more information)
                  additionalProperties: false
              type:
                type: string
              var_group_selections:
                type: object
                additionalProperties:
                  maxLength: 1024
                  type: string
                description: Variable group selections. Maps var_group name to the selected option name within that group.
              vars:
                type: object
                additionalProperties:
                  required:
                    - value
                  type: object
                  properties:
                    frozen:
                      type: boolean
                    type:
                      type: string
                    value: { }
                  additionalProperties: false
                description: Package variable (see integration documentation for more information)
            additionalProperties: false
        is_managed:
          type: boolean
        name:
          type: string
        namespace:
          maxLength: 100
          type: string
          description: The package policy namespace. Leave blank to inherit the agent policy's namespace.
        output_id:
          type:
            - 'null'
            - string
        overrides:
          type:
            - 'null'
            - object
          properties:
            inputs:
              type: object
              additionalProperties: { }
          additionalProperties: false
          description: Override settings that are defined in the package policy. The override option should be used only in unusual circumstances and not as a routine procedure.
        package:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_package_policy_package'
        package_agent_version_condition:
          type: string
        policy_id:
          type:
            - 'null'
            - string
          description: ID of the agent policy which the package policy will be added to.
          deprecated: true
        policy_ids:
          maxItems: 1000
          type: array
          items:
            type: string
            description: IDs of the agent policies that the package policy will be added to.
        spaceIds:
          maxItems: 100
          type: array
          items:
            type: string
        supports_agentless:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy belongs to an agentless agent policy.
        supports_cloud_connector:
          type:
            - 'null'
            - boolean
          description: Indicates whether the package policy supports cloud connectors.
        var_group_selections:
          type: object
          additionalProperties:
            maxLength: 1024
            type: string
          description: Variable group selections. Maps var_group name to the selected option name within that group.
        vars:
          type: object
          additionalProperties:
            required:
              - value
            type: object
            properties:
              frozen:
                type: boolean
              type:
                type: string
              value: { }
            additionalProperties: false
          description: Package variable (see integration documentation for more information)
        version:
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_update_package_request:
      title: update_package_request
      type: object
      properties:
        keepPoliciesUpToDate:
          type: boolean
        namespace_customization_enabled_for:
          maxItems: 100
          type: array
          items:
            maxLength: 100
            type: string
          description: Namespaces for which namespace-level customization is enabled on this package.
        namespace_customization_settings:
          type: object
          additionalProperties:
            type: object
            properties:
              ilm_policy:
                maxLength: 1024
                minLength: 1
                type: string
          description: 'Per-namespace managed settings (for example, ILM policy) for this package. Keyed by namespace name.'
      additionalProperties: false
    Kibana_HTTP_APIs_update_package_response:
      title: update_package_response
      required:
        - item
      type: object
      properties:
        item:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_get_package_info'
        warnings:
          maxItems: 100
          type: array
          items:
            required:
              - dataStreamName
              - namespace
              - baseTemplateName
              - nsTemplateName
              - conflictingTemplates
            type: object
            properties:
              baseTemplateName:
                maxLength: 1000
                type: string
              conflictingTemplates:
                maxItems: 100
                type: array
                items:
                  required:
                    - name
                    - priority
                    - conflictType
                  type: object
                  properties:
                    conflictType:
                      enum:
                        - overrides_fleet
                        - blocked_by_same_priority
                        - overridden_by_fleet
                      type: string
                    name:
                      maxLength: 1000
                      type: string
                    priority:
                      type: number
                  additionalProperties: false
              dataStreamName:
                maxLength: 1000
                type: string
              namespace:
                maxLength: 255
                type: string
              nsTemplateName:
                maxLength: 1000
                type: string
            additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_update_rule:
      title: update_rule
      required:
        - name
        - schedule
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_update_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          type: object
          additionalProperties: { }
          description: The parameters for the rule.
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
        tags:
          type: array
          items:
            type: string
            description: The tags for the rule.
          default: [ ]
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_update_rule_action:
      title: update_rule_action
      required:
        - id
      type: object
      properties:
        alerts_filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_update_rule_action_alerts_filter'
        frequency:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_update_rule_action_frequency'
        group:
          type: string
          description: 'The group name, which affects when the action runs (for example, when the threshold is met or when the alert is recovered). Each rule type has a list of valid action group names. If you don''t need to group actions, set to `default`.'
        id:
          type: string
          description: The identifier for the connector saved object.
        params:
          type: object
          additionalProperties: { }
          description: 'The parameters for the action, which are sent to the connector. The `params` are handled as Mustache templates and passed a default set of context.'
        use_alert_data_for_template:
          type: boolean
          description: Indicates whether to use alert data as a template.
        uuid:
          type: string
          description: A universally unique identifier (UUID) for the action.
      additionalProperties: false
      description: An action that runs under defined conditions.
    Kibana_HTTP_APIs_update_rule_action_alerts_filter:
      title: update_rule_action_alerts_filter
      type: object
      properties:
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_alerts_filter_query'
        timeframe:
          required:
            - days
            - hours
            - timezone
          type: object
          properties:
            days:
              type: array
              items:
                enum:
                  - 1
                  - 2
                  - 3
                  - 4
                  - 5
                  - 6
                  - 7
                type: integer
              description: 'Defines the days of the week that the action can run, represented as an array of numbers. For example, `1` represents Monday. An empty array is equivalent to specifying all the days of the week.'
            hours:
              required:
                - start
                - end
              type: object
              properties:
                end:
                  type: string
                  description: 'The end of the time frame, in 24-hour notation (`hh:mm`).'
                start:
                  type: string
                  description: 'The start of the time frame, in 24-hour notation (`hh:mm`).'
              additionalProperties: false
              description: 'Defines the range of time in a day that the action can run. If the `start` value is `00:00` and the `end` value is `24:00`, actions be generated all day.'
            timezone:
              type: string
              description: The ISO time zone for the `hours` values. Values such as `UTC` and `UTC+1` also work but lack built-in support for daylight savings time and are not recommended.
          additionalProperties: false
          description: Defines a period that limits whether the action runs.
      additionalProperties: false
    Kibana_HTTP_APIs_update_rule_action_frequency:
      title: update_rule_action_frequency
      required:
        - summary
        - notify_when
      type: object
      properties:
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
          type: string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        summary:
          type: boolean
          description: Indicates whether the action is a summary.
        throttle:
          type:
            - 'null'
            - string
          description: 'The throttle interval defines how frequently rule actions are triggered. It is specified in seconds, minutes, hours, or days and only applies when `notify_when` is set to `onThrottleInterval`. You cannot set the throttle interval at both the rule and action level. The recommended approach is to set it for each action individually. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
          default: 'null'
      additionalProperties: false
    Kibana_HTTP_APIs_upgrade_package_policies_request:
      title: upgrade_package_policies_request
      required:
        - packagePolicyIds
      type: object
      properties:
        packagePolicyIds:
          maxItems: 1000
          type: array
          items:
            type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visApiConfig:
      title: Visualizations
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegacyMetricNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTagcloudChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRegionMapChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapChart'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleChart'
      description: Visualization configuration. Use the `type` field to specify the chart type. Each chart type has its own set of required and optional fields.
    Kibana_HTTP_APIs_visApiDirection:
      enum:
        - asc
        - desc
      type: string
      description: Direction
    Kibana_HTTP_APIs_visApiDomainCustom:
      required:
        - type
        - min
        - max
      type: object
      properties:
        max:
          type: number
          description: Max domain value
        min:
          type: number
          description: Min domain value
        rounding:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainRounding'
        type:
          enum:
            - custom
          type: string
      additionalProperties: false
      description: Uses explicitly provided domain bounds (min and max).
    Kibana_HTTP_APIs_visApiDomainFit:
      required:
        - type
      type: object
      properties:
        rounding:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainRounding'
        type:
          enum:
            - fit
          type: string
      additionalProperties: false
      description: 'Uses tight domain bounds from the observed data minimum to maximum, without baseline expansion.'
    Kibana_HTTP_APIs_visApiDomainFull:
      required:
        - type
      type: object
      properties:
        rounding:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainRounding'
        type:
          enum:
            - full
          type: string
      additionalProperties: false
      description: 'Uses the full chart domain, including baseline expansion when applicable (for example, includes zero for bar-like series).'
    Kibana_HTTP_APIs_visApiDomainRounding:
      type: boolean
      description: 'Whether to round axis domain bounds outward to readable “nice” values (for example 1, 5, 10, 100) instead of exact data min/max.'
      default: true
    Kibana_HTTP_APIs_visApiOrientation:
      enum:
        - horizontal
        - vertical
        - angled
      type: string
      description: Orientation
    Kibana_HTTP_APIs_visApiSimpleOrientation:
      enum:
        - horizontal
        - vertical
      type: string
      description: Orientation
    Kibana_HTTP_APIs_visApiXyAxisConfig:
      title: Axis
      type: object
      properties:
        x:
          type: object
          properties:
            domain:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom'
              description: X-axis domain configuration
            grid:
              required:
                - visible
              type: object
              properties:
                visible:
                  type: boolean
                  description: Show grid lines for this axis
              additionalProperties: false
              description: Axis grid lines configuration
            labels:
              type: object
              properties:
                orientation:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiOrientation'
              additionalProperties: false
              description: Label configuration
            scale:
              anyOf:
                - enum:
                    - ordinal
                  type: string
                - enum:
                    - temporal
                  type: string
                - enum:
                    - linear
                  type: string
              description: 'X-axis scale type. Use ''temporal'' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use ''ordinal'' for categorical/text fields. Use ''linear'' for numeric fields.'
            ticks:
              required:
                - visible
              type: object
              properties:
                visible:
                  type: boolean
                  description: Show tick marks on the axis
              additionalProperties: false
              description: Axis tick marks configuration
            title:
              type: object
              properties:
                text:
                  type: string
                  description: Axis title text.
                  default: ''
                visible:
                  type: boolean
                  description: 'When `true`, displays the title.'
              additionalProperties: false
              description: Axis title configuration
          additionalProperties: false
          description: X-axis configuration
        y:
          type: object
          properties:
            domain:
              oneOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom'
              description: Y-axis domain configuration
              default:
                rounding: true
                type: full
              discriminator:
                propertyName: type
                mapping:
                  custom: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom'
                  fit: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit'
                  full: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull'
            grid:
              required:
                - visible
              type: object
              properties:
                visible:
                  type: boolean
                  description: Show grid lines for this axis
              additionalProperties: false
              description: Axis grid lines configuration
            labels:
              type: object
              properties:
                orientation:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiOrientation'
              additionalProperties: false
              description: Label configuration
            scale:
              anyOf:
                - enum:
                    - linear
                  type: string
                - enum:
                    - log
                  type: string
                - enum:
                    - sqrt
                  type: string
              description: Y-axis scale type for data transformation
            ticks:
              required:
                - visible
              type: object
              properties:
                visible:
                  type: boolean
                  description: Show tick marks on the axis
              additionalProperties: false
              description: Axis tick marks configuration
            title:
              type: object
              properties:
                text:
                  type: string
                  description: Axis title text.
                  default: ''
                visible:
                  type: boolean
                  description: 'When `true`, displays the title.'
              additionalProperties: false
              description: Axis title configuration
          additionalProperties: false
          description: 'Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).'
        y2:
          type: object
          properties:
            domain:
              oneOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom'
              description: Y-axis domain configuration
              default:
                rounding: true
                type: full
              discriminator:
                propertyName: type
                mapping:
                  custom: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainCustom'
                  fit: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFit'
                  full: '#/components/schemas/Kibana_HTTP_APIs_visApiDomainFull'
            grid:
              required:
                - visible
              type: object
              properties:
                visible:
                  type: boolean
                  description: Show grid lines for this axis
              additionalProperties: false
              description: Axis grid lines configuration
            labels:
              type: object
              properties:
                orientation:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiOrientation'
              additionalProperties: false
              description: Label configuration
            scale:
              anyOf:
                - enum:
                    - linear
                  type: string
                - enum:
                    - log
                  type: string
                - enum:
                    - sqrt
                  type: string
              description: Y-axis scale type for data transformation
            ticks:
              required:
                - visible
              type: object
              properties:
                visible:
                  type: boolean
                  description: Show tick marks on the axis
              additionalProperties: false
              description: Axis tick marks configuration
            title:
              type: object
              properties:
                text:
                  type: string
                  description: Axis title text.
                  default: ''
                visible:
                  type: boolean
                  description: 'When `true`, displays the title.'
              additionalProperties: false
              description: Axis title configuration
          additionalProperties: false
          description: 'Y-axis configuration with scale and bounds. The axis position is determined by the key: y renders on the start side (left in vertical charts), y2 on the end side (right in vertical charts).'
      additionalProperties: false
      description: 'Axis configuration for X, Y, and Y2 axes. The Y axis is on the start (leading) side, the Y2 axis is on the end (trailing) side.'
    Kibana_HTTP_APIs_visAutoColor:
      title: Auto Color
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - auto
          type: string
      additionalProperties: false
      description: Coloring determined at runtime based on chart defaults
    Kibana_HTTP_APIs_visByteFormat:
      title: Byte Format
      required:
        - type
      type: object
      properties:
        decimals:
          type: number
          description: Number of decimal places to display.
          default: 2
        suffix:
          type: string
          description: Suffix appended to the formatted value.
        type:
          anyOf:
            - enum:
                - bits
              type: string
            - enum:
                - bytes
              type: string
          description: 'Data size unit: `bits` or `bytes`.'
      additionalProperties: false
      description: 'Data size format in bits or bytes, with optional decimal places and suffix.'
    Kibana_HTTP_APIs_visCategoricalColorMapping:
      title: Categorical Color Mapping
      required:
        - mode
        - palette
        - mapping
      type: object
      properties:
        mapping:
          maxItems: 1000
          type: array
          items:
            required:
              - values
              - color
            type: object
            properties:
              color:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorFromPalette'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorCode'
              values:
                maxItems: 1000
                type: array
                items:
                  anyOf:
                    - type: string
                    - type: number
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangeKey'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMultiFieldKey'
            additionalProperties: false
        mode:
          enum:
            - categorical
          type: string
        palette:
          type: string
          description: 'Color palette name. Accepted values: ''default'', ''elastic_line_optimized'', ''severity'', ''eui_amsterdam'', ''kibana_v7_legacy'', ''elastic_brand_2023''. Defaults to `default`.'
        unassigned:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visUnassignedColorSchema'
      additionalProperties: false
      description: Palette color assignment for specific categorical values. Unmapped values receive the unassigned color.
    Kibana_HTTP_APIs_visCollapseBy:
      anyOf:
        - enum:
            - avg
          type: string
        - enum:
            - sum
          type: string
        - enum:
            - max
          type: string
        - enum:
            - min
          type: string
      description: Aggregation function used to collapse a breakdown dimension into a single value.
    Kibana_HTTP_APIs_visColorByValue:
      title: Color By Value
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValueAbsolute'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValuePercentage'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValuePalette'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegacyColorByValue'
      description: 'Dynamic color mapping by numeric range, with support for absolute and percentage-based ranges and for named palettes.'
    Kibana_HTTP_APIs_visColorByValueAbsolute:
      title: Color By Value (Absolute)
      required:
        - type
        - range
        - steps
      type: object
      properties:
        range:
          enum:
            - absolute
          type: string
        steps:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - color
            type: object
            properties:
              color:
                type: string
                description: The color to use for this step.
              gte:
                type:
                  - 'null'
                  - number
                description: The lower bound of range from which this color applies (inclusive).
              lt:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (exclusive).
              lte:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (inclusive).
            additionalProperties: false
          description: Array of ordered color steps defining the range each color is applied.
        type:
          enum:
            - dynamic
          type: string
      additionalProperties: false
      description: Color by absolute value configuration
    Kibana_HTTP_APIs_visColorByValuePalette:
      title: Color By Value (Palette)
      required:
        - type
        - palette
      type: object
      properties:
        palette:
          anyOf:
            - enum:
                - status
              type: string
            - enum:
                - temperature
              type: string
            - enum:
                - complementary
              type: string
            - enum:
                - negative
              type: string
            - enum:
                - positive
              type: string
            - enum:
                - cool
              type: string
            - enum:
                - warm
              type: string
            - enum:
                - gray
              type: string
          description: The name of the palette to apply across the value range.
        type:
          enum:
            - distributed_palette
          type: string
      additionalProperties: false
      description: 'Color by value using a palette, with colors distributed across the range of values.'
    Kibana_HTTP_APIs_visColorByValuePercentage:
      title: Color By Value (Percentage)
      required:
        - type
        - range
        - steps
      type: object
      properties:
        range:
          enum:
            - percentage
          type: string
        steps:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - color
            type: object
            properties:
              color:
                type: string
                description: The color to use for this step.
              gte:
                type:
                  - 'null'
                  - number
                description: The lower bound of range from which this color applies (inclusive).
              lt:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (exclusive).
              lte:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (inclusive).
            additionalProperties: false
          description: Array of ordered color steps defining the range each color is applied.
        type:
          enum:
            - dynamic
          type: string
      additionalProperties: false
      description: Color by percentage value configuration
    Kibana_HTTP_APIs_visColorCode:
      title: Color Code
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - color_code
          type: string
        value:
          type: string
          description: The static color value to use.
      additionalProperties: false
      description: A color specified as a hex or CSS color code string.
    Kibana_HTTP_APIs_visColorFromPalette:
      title: Color From Palette
      required:
        - type
        - index
      type: object
      properties:
        index:
          type: number
          description: The index of the color in the palette.
        palette:
          type: string
          description: 'Color palette name. Accepted values: ''default'', ''elastic_line_optimized'', ''severity'', ''eui_amsterdam'', ''kibana_v7_legacy'', ''elastic_brand_2023''. Defaults to `default`.'
        type:
          enum:
            - from_palette
          type: string
      additionalProperties: false
      description: Color at a fixed index position in a named palette.
    Kibana_HTTP_APIs_visColorMapping:
      title: Color Mapping
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCategoricalColorMapping'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visGradientColorMapping'
      description: 'Color mapping for dimension values, either categorical (for specific values) or as a gradient.'
      default:
        mapping: [ ]
        mode: categorical
        palette: default
    Kibana_HTTP_APIs_visCounterRateOperation:
      title: Counter Rate Operation
      required:
        - field
        - operation
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - counter_rate
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visCountMetricOperation:
      title: Count Metric Operation
      required:
        - operation
      type: object
      properties:
        empty_as_null:
          type: boolean
          description: 'When `true`, treats empty buckets as null instead of zero.'
          default: false
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - count
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visCumulativeSumOperation:
      title: Cumulative Sum Operation
      required:
        - operation
      type: object
      properties:
        field:
          type: string
          description: 'Field to cumulatively sum. When omitted, cumulative sum is applied to the count of records.'
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - cumulative_sum
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visCustomFormat:
      title: Custom Format
      required:
        - type
        - pattern
      type: object
      properties:
        pattern:
          type: string
          description: Kibana field format pattern string.
        type:
          enum:
            - custom
          type: string
      additionalProperties: false
      description: Custom format using a Kibana field format pattern string.
    Kibana_HTTP_APIs_visDatatableChart:
      title: Datatable
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableESQL'
      description: 'Datatable chart configuration: DSL or ES|QL query based'
    Kibana_HTTP_APIs_visDatatableDensity:
      type: object
      properties:
        height:
          type: object
          properties:
            header:
              anyOf:
                - required:
                    - type
                  type: object
                  properties:
                    type:
                      enum:
                        - auto
                      type: string
                  additionalProperties: false
                - required:
                    - type
                  type: object
                  properties:
                    max_lines:
                      maximum: 5
                      minimum: 1
                      type: number
                      default: 3
                    type:
                      enum:
                        - custom
                      type: string
                  additionalProperties: false
              description: Number of lines before the header is truncated.
            value:
              anyOf:
                - required:
                    - type
                  type: object
                  properties:
                    type:
                      enum:
                        - auto
                      type: string
                  additionalProperties: false
                - required:
                    - type
                  type: object
                  properties:
                    lines:
                      maximum: 20
                      minimum: 1
                      type: number
                      default: 1
                    type:
                      enum:
                        - custom
                      type: string
                  additionalProperties: false
              description: Number of lines to display per table body cell.
          additionalProperties: false
        mode:
          anyOf:
            - enum:
                - compact
              type: string
            - enum:
                - default
              type: string
            - enum:
                - expanded
              type: string
          description: Display density mode.
          default: default
      additionalProperties: false
      description: Density configuration for the datatable.
    Kibana_HTTP_APIs_visDatatableESQL:
      title: Datatable (ES|QL)
      required:
        - type
        - data_source
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metrics:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableESQLMetric'
          description: Array of metrics to display as columns in the datatable
        rows:
          maxItems: 50
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              alignment:
                enum:
                  - left
                  - center
                  - right
                type: string
                description: Alignment of the rows.
                default: left
              apply_color_to:
                anyOf:
                  - enum:
                      - value
                      - background
                    type: string
                    description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                  - enum:
                      - badge
                    type: string
                description: 'Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay.'
              click_filter:
                type: boolean
                description: 'When `true`, enables one-click filtering on cell values.'
                default: false
              collapse_by:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
              color:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                description: Color configuration for ESQL datatable rows. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
                default:
                  type: auto
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
              visible:
                type: boolean
                description: 'When `false`, hides the column from the datatable.'
                default: true
              width:
                minimum: 0
                type: number
                description: Column width in pixels.
          description: Array of operations to split the datatable rows by
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        split_metrics_by:
          maxItems: 20
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of operations to split the metric columns by
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - data_table
          type: string
      additionalProperties: false
      description: Datatable state configuration for ES|QL queries
    Kibana_HTTP_APIs_visDatatableESQLMetric:
      title: Datatable Metric (ES|QL)
      required:
        - column
      type: object
      properties:
        alignment:
          enum:
            - left
            - center
            - right
          type: string
          description: Alignment of the columns.
          default: right
        apply_color_to:
          anyOf:
            - enum:
                - value
                - background
              type: string
              description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
            - enum:
                - badge
              type: string
          description: 'Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay.'
        color:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
          description: Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
          default:
            type: auto
        column:
          type: string
          description: Column to use
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        summary:
          required:
            - type
          type: object
          properties:
            label:
              type: string
              description: Summary row label.
            type:
              anyOf:
                - enum:
                    - sum
                  type: string
                - enum:
                    - avg
                  type: string
                - enum:
                    - count
                  type: string
                - enum:
                    - min
                  type: string
                - enum:
                    - max
                  type: string
              description: Type of summary function to apply to the column.
          additionalProperties: false
          description: Summary row configuration
        visible:
          type: boolean
          description: 'When `false`, hides the column from the datatable.'
          default: true
        width:
          minimum: 0
          type: number
          description: Column width in pixels.
      additionalProperties: false
    Kibana_HTTP_APIs_visDatatableMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visDatatableMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visDatatableMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visDatatableMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visDatatableMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visDatatableMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visDatatableMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visDatatableMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visDatatableMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visDatatableMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visDatatableMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visDatatableMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visDatatableNoESQL:
      title: Datatable (DSL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metrics:
          maxItems: 1000
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  alignment:
                    enum:
                      - left
                      - center
                      - right
                    type: string
                    description: Alignment of the columns.
                    default: right
                  apply_color_to:
                    anyOf:
                      - enum:
                          - value
                          - background
                        type: string
                        description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                      - enum:
                          - badge
                        type: string
                    description: 'Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay.'
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    description: Color configuration for datatable metrics. Use dynamic coloring for numeric data and categorical/gradient mode for categorical data.
                    default:
                      type: auto
                  summary:
                    required:
                      - type
                    type: object
                    properties:
                      label:
                        type: string
                        description: Summary row label.
                      type:
                        anyOf:
                          - enum:
                              - sum
                            type: string
                          - enum:
                              - avg
                            type: string
                          - enum:
                              - count
                            type: string
                          - enum:
                              - min
                            type: string
                          - enum:
                              - max
                            type: string
                        description: Type of summary function to apply to the column.
                    additionalProperties: false
                    description: Summary row configuration
                  visible:
                    type: boolean
                    description: 'When `false`, hides the column from the datatable.'
                    default: true
                  width:
                    minimum: 0
                    type: number
                    description: Column width in pixels.
                additionalProperties: false
          description: Array of metrics to display as columns in the datatable
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        rows:
          maxItems: 50
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  alignment:
                    enum:
                      - left
                      - center
                      - right
                    type: string
                    description: Alignment of the rows.
                    default: left
                  apply_color_to:
                    anyOf:
                      - enum:
                          - value
                          - background
                        type: string
                        description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                      - enum:
                          - badge
                        type: string
                    description: 'Column color target: `value` for cell text, `background` for cell background, or `badge` for a badge overlay.'
                  click_filter:
                    type: boolean
                    description: 'When `true`, enables one-click filtering on cell values.'
                    default: false
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
                  visible:
                    type: boolean
                    description: 'When `false`, hides the column from the datatable.'
                    default: true
                  width:
                    minimum: 0
                    type: number
                    description: Column width in pixels.
                additionalProperties: false
          description: Array of operations to split the datatable rows by
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        split_metrics_by:
          maxItems: 20
          minItems: 1
          type: array
          items:
            title: Breakdown Operation
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            description: 'Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.'
          description: Array of operations to split the metric columns by
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - data_table
          type: string
      additionalProperties: false
      description: Datatable state configuration for standard queries
    Kibana_HTTP_APIs_visDatatableRowDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visDatatableRowFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visDatatableRowHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visDatatableRowRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visDatatableRowTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visDatatableStyling:
      title: Datatable styling
      type: object
      properties:
        density:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visDatatableDensity'
        paging:
          anyOf:
            - enum:
                - 10
              type: number
            - enum:
                - 20
              type: number
            - enum:
                - 30
              type: number
            - enum:
                - 50
              type: number
            - enum:
                - 100
              type: number
          description: 'Rows per page. When set, pagination is enabled with the specified number of rows.'
        row_numbers:
          required:
            - visible
          type: object
          properties:
            visible:
              type: boolean
              description: 'When `true`, displays row numbers.'
          additionalProperties: false
          description: Configuration for row numbers
        sort_by:
          anyOf:
            - required:
                - column_type
                - index
                - direction
              type: object
              properties:
                column_type:
                  anyOf:
                    - enum:
                        - metric
                      type: string
                    - enum:
                        - row
                      type: string
                  description: Type of column to sort by.
                direction:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
                index:
                  minimum: 0
                  type: number
                  description: Index of the column or row to sort by (0-based).
              additionalProperties: false
              description: Sort by a metric or row column
            - required:
                - column_type
                - index
                - values
                - direction
              type: object
              properties:
                column_type:
                  enum:
                    - pivoted_metric
                  type: string
                direction:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
                index:
                  minimum: 0
                  type: number
                  description: 0-based index into the "metrics" array for the metric to sort; use "values" to identify the pivoted column
                values:
                  maxItems: 20
                  minItems: 1
                  type: array
                  items:
                    type: string
                  description: 'Array of pivot values, one for each split_metrics_by column in order'
              additionalProperties: false
              description: Sort by a pivoted metric column (created when metrics are pivoted by split_metrics_by)
          description: Sorting configuration. Only one column can be sorted at a time. Use "column_type" to specify the column type.
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visDateHistogramOperation:
      title: Date Histogram Operation
      required:
        - operation
        - field
      type: object
      properties:
        drop_partial_intervals:
          type: boolean
          description: 'When `true`, drops partial intervals from the results.'
          default: false
        field:
          type: string
          description: Field to be used for the date histogram.
        include_empty_rows:
          type: boolean
          description: 'When `true`, includes empty rows in the results.'
          default: true
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - date_histogram
          type: string
        suggested_interval:
          type: string
          description: Suggested time interval.
          default: auto
        use_original_time_range:
          type: boolean
          description: 'When `true`, uses the original time range instead of the current query time range.'
          default: false
      additionalProperties: false
    Kibana_HTTP_APIs_visDifferencesOperation:
      title: Differences Operation
      required:
        - operation
        - of
      type: object
      properties:
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        of:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
        operation:
          enum:
            - differences
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visDurationFormat:
      title: Duration Format
      required:
        - type
        - from
        - to
      type: object
      properties:
        compact:
          type: boolean
          description: 'When `true`, uses short unit suffixes (for example, `ms` instead of `Milliseconds`). Defaults to `true`. Ignored for `auto-approximate`.'
        decimals:
          type: number
          description: Number of decimal places to display. Defaults to `0`. Ignored for `auto-approximate`.
        from:
          enum:
            - ps
            - ns
            - us
            - ms
            - s
            - min
            - h
            - d
            - w
            - mo
            - y
          type: string
          description: 'Source time unit of the raw field value, including fine-grained units (`ps`, `ns`, `us`) in addition to standard units. This describes how the stored data is encoded, not a query duration literal.'
        suffix:
          type: string
          description: Suffix appended to the formatted value.
        to:
          enum:
            - auto
            - auto-approximate
            - ms
            - s
            - min
            - h
            - d
            - w
            - mo
            - y
          type: string
          description: 'Display time unit: `auto` (precise), `auto-approximate`, or a fixed conversion unit.'
        type:
          enum:
            - duration
          type: string
      additionalProperties: false
      description: Duration format between time units.
    Kibana_HTTP_APIs_visFieldMetricOperations:
      title: Field Metric Operations
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visFilterSimple:
      title: Filter
      required:
        - expression
      type: object
      properties:
        expression:
          type: string
          description: A query expression in KQL or Lucene syntax
        language:
          anyOf:
            - enum:
                - kql
              type: string
            - enum:
                - lucene
              type: string
          description: 'Query language: `kql` (Kibana Query Language) or `lucene`. Defaults to `kql`.'
          default: kql
      additionalProperties: false
      description: A KQL or Lucene query that filters panel data. Applied on top of any dashboard-level filters.
    Kibana_HTTP_APIs_visFiltersOperation:
      title: Filters Operation
      required:
        - operation
        - filters
      type: object
      properties:
        filters:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterWithLabel'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - filters
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visFilterWithLabel:
      title: Filter with Label
      required:
        - filter
      type: object
      properties:
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        label:
          type: string
          description: Label for the filter
      additionalProperties: false
      description: A KQL or Lucene filter with an optional display label.
    Kibana_HTTP_APIs_visFormatType:
      title: Format Type
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNumericFormat'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visByteFormat'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDurationFormat'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCustomFormat'
      description: Number display format for the dimension value.
    Kibana_HTTP_APIs_visFormulaOperation:
      title: Formula Operation
      required:
        - operation
        - formula
      type: object
      properties:
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        formula:
          type: string
          description: Formula
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - formula
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          anyOf:
            - enum:
                - s
              type: string
            - enum:
                - m
              type: string
            - enum:
                - h
              type: string
            - enum:
                - d
              type: string
          description: Time scale
      additionalProperties: false
    Kibana_HTTP_APIs_visGaugeChart:
      title: Gauge Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeESQL'
      description: 'A gauge chart with a metric value and optional minimum, maximum, and goal markers, in bullet or circular shape.'
    Kibana_HTTP_APIs_visGaugeESQL:
      title: Gauge Chart (ES|QL)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          required:
            - column
          type: object
          properties:
            color:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNoColor'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
              description: Color configuration for the gauge fill.
              default:
                type: auto
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            goal:
              required:
                - column
              type: object
              properties:
                column:
                  type: string
                  description: Column to use
                label:
                  type: string
                  description: Label for the operation
              additionalProperties: false
            label:
              type: string
              description: Label for the operation
            max:
              required:
                - column
              type: object
              properties:
                column:
                  type: string
                  description: Column to use
                label:
                  type: string
                  description: Label for the operation
              additionalProperties: false
            min:
              required:
                - column
              type: object
              properties:
                column:
                  type: string
                  description: Column to use
                label:
                  type: string
                  description: Label for the operation
              additionalProperties: false
            subtitle:
              type: string
              description: Subtitle below the gauge value.
            ticks:
              type: object
              properties:
                mode:
                  anyOf:
                    - enum:
                        - auto
                      type: string
                    - enum:
                        - bands
                      type: string
                  description: Tick placement mode.
                  default: bands
                visible:
                  type: boolean
                  description: 'When `true`, displays tick marks on the gauge.'
                  default: true
              additionalProperties: false
              description: Ticks configuration
            title:
              type: object
              properties:
                text:
                  type: string
                  description: Title text.
                visible:
                  type: boolean
                  description: 'When `true`, displays the title.'
                  default: true
              additionalProperties: false
              description: Title configuration
          additionalProperties: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - gauge
          type: string
      additionalProperties: false
      description: Gauge configuration using an ES|QL query.
    Kibana_HTTP_APIs_visGaugeMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visGaugeMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visGaugeMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visGaugeMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visGaugeMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visGaugeMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visGaugeMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visGaugeMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visGaugeNoESQL:
      title: Gauge Chart (DSL)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          allOf:
            - anyOf:
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
            - type: object
              properties:
                color:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNoColor'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                  description: Color configuration for the gauge fill.
                  default:
                    type: auto
                goal:
                  title: 'Field Metric, Static Value, or Formula Operation'
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  description: 'Metric dimension using a field-based aggregation, a static value, or a mathematical formula.'
                max:
                  title: 'Field Metric, Static Value, or Formula Operation'
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  description: 'Metric dimension using a field-based aggregation, a static value, or a mathematical formula.'
                min:
                  title: 'Field Metric, Static Value, or Formula Operation'
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  description: 'Metric dimension using a field-based aggregation, a static value, or a mathematical formula.'
                subtitle:
                  type: string
                  description: Subtitle below the gauge value.
                ticks:
                  type: object
                  properties:
                    mode:
                      anyOf:
                        - enum:
                            - auto
                          type: string
                        - enum:
                            - bands
                          type: string
                      description: Tick placement mode.
                      default: bands
                    visible:
                      type: boolean
                      description: 'When `true`, displays tick marks on the gauge.'
                      default: true
                  additionalProperties: false
                  description: Ticks configuration
                title:
                  type: object
                  properties:
                    text:
                      type: string
                      description: Title text.
                    visible:
                      type: boolean
                      description: 'When `true`, displays the title.'
                      default: true
                  additionalProperties: false
                  description: Title configuration
              additionalProperties: false
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - gauge
          type: string
      additionalProperties: false
      description: Gauge configuration using a data view.
    Kibana_HTTP_APIs_visGaugeShapeBullet:
      title: Shape (Bullet)
      required:
        - type
      type: object
      properties:
        orientation:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiSimpleOrientation'
        type:
          enum:
            - bullet
          type: string
      additionalProperties: false
      description: Bullet gauge shape.
    Kibana_HTTP_APIs_visGaugeShapeCircular:
      title: Shape (Circular)
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - circle
            - semi_circle
            - arc
          type: string
      additionalProperties: false
      description: Circular gauge shape.
    Kibana_HTTP_APIs_visGaugeStyling:
      title: Gauge styling
      type: object
      properties:
        shape:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeShapeBullet'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visGaugeShapeCircular'
          default:
            orientation: horizontal
            type: bullet
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visGradientColorMapping:
      title: Gradient Color Mapping
      required:
        - mode
        - palette
      type: object
      properties:
        gradient:
          maxItems: 3
          type: array
          items:
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorFromPalette'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorCode'
        mapping:
          maxItems: 100
          type: array
          items:
            required:
              - values
            type: object
            properties:
              values:
                maxItems: 100
                type: array
                items:
                  anyOf:
                    - type: string
                    - type: number
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangeKey'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMultiFieldKey'
            additionalProperties: false
        mode:
          enum:
            - gradient
          type: string
        palette:
          type: string
          description: 'Color palette name. Accepted values: ''default'', ''elastic_line_optimized'', ''severity'', ''eui_amsterdam'', ''kibana_v7_legacy'', ''elastic_brand_2023''. Defaults to `default`.'
        sort:
          anyOf:
            - enum:
                - asc
              type: string
            - enum:
                - desc
              type: string
          description: Sort direction
        unassigned:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visUnassignedColorSchema'
      additionalProperties: false
      description: Gradient color mapping across categorical values.
    Kibana_HTTP_APIs_visHeatmapAxes:
      title: Axes
      type: object
      properties:
        x:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapXAxis'
        y:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapYAxis'
      additionalProperties: false
      description: Axis configuration for X and Y axes
    Kibana_HTTP_APIs_visHeatmapCells:
      title: Cells
      type: object
      properties:
        labels:
          type: object
          properties:
            visible:
              type: boolean
              description: Show cell labels
              default: false
          additionalProperties: false
      additionalProperties: false
      description: Cells configuration
    Kibana_HTTP_APIs_visHeatmapChart:
      title: Heatmap Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapESQL'
      description: A grid of colored cells where color intensity represents the metric value at each X/Y intersection.
    Kibana_HTTP_APIs_visHeatmapESQL:
      title: Heatmap Chart (ES|QL)
      required:
        - type
        - x
        - data_source
        - metric
      type: object
      properties:
        axis:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapAxes'
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapLegend'
        metric:
          required:
            - column
          type: object
          properties:
            color:
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
              description: Color scale configuration for the heatmap cells.
              default:
                type: auto
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - heatmap
          type: string
        x:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        y:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
      additionalProperties: false
      description: Heatmap configuration using an ES|QL query.
    Kibana_HTTP_APIs_visHeatmapLegend:
      title: Legend
      type: object
      properties:
        position:
          enum:
            - top
            - bottom
            - left
            - right
          type: string
        size:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendSize'
        truncate_after_lines:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
        visibility:
          anyOf:
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Legend configuration
    Kibana_HTTP_APIs_visHeatmapMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visHeatmapMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visHeatmapMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visHeatmapMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visHeatmapMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visHeatmapMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visHeatmapMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visHeatmapMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visHeatmapMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visHeatmapMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visHeatmapMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visHeatmapMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visHeatmapNoESQL:
      title: Heatmap Chart (DSL)
      required:
        - type
        - x
        - data_source
        - metric
      type: object
      properties:
        axis:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapAxes'
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapLegend'
        metric:
          allOf:
            - anyOf:
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
            - type: object
              properties:
                color:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                  description: Color scale configuration for the heatmap cells.
                  default:
                    type: auto
              additionalProperties: false
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - heatmap
          type: string
        x:
          title: Breakdown Operation
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
          description: 'Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.'
        y:
          title: Breakdown Operation
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
          description: 'Breakdown dimension configuration using date histogram, terms, numeric histogram, value ranges, or custom filters.'
      additionalProperties: false
      description: Heatmap configuration using a data view.
    Kibana_HTTP_APIs_visHeatmapStyling:
      title: Heatmap styling
      type: object
      properties:
        cells:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visHeatmapCells'
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visHeatmapXAxis:
      title: X Axis
      required:
        - scale
      type: object
      properties:
        labels:
          type: object
          properties:
            orientation:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiOrientation'
            visible:
              type: boolean
              description: Show axis labels
              default: true
          additionalProperties: false
        scale:
          anyOf:
            - enum:
                - ordinal
              type: string
            - enum:
                - temporal
              type: string
            - enum:
                - linear
              type: string
          description: 'X-axis scale type. Use ''temporal'' for timestamp/date fields (for example, @timestamp or DATE_TRUNC results). Use ''ordinal'' for categorical/text fields. Use ''linear'' for numeric fields.'
        sort:
          anyOf:
            - enum:
                - asc
              type: string
            - enum:
                - desc
              type: string
          description: Axis sort order; omit or use undefined for no sorting
        title:
          type: object
          properties:
            text:
              type: string
              description: Axis title text.
              default: ''
            visible:
              type: boolean
              description: 'When `true`, displays the title.'
          additionalProperties: false
      additionalProperties: false
      description: X axis configuration
    Kibana_HTTP_APIs_visHeatmapYAxis:
      title: Y Axis
      type: object
      properties:
        labels:
          type: object
          properties:
            visible:
              type: boolean
              description: Show axis labels
              default: true
          additionalProperties: false
        sort:
          anyOf:
            - enum:
                - asc
              type: string
            - enum:
                - desc
              type: string
          description: Axis sort order; omit or use undefined for no sorting
        title:
          type: object
          properties:
            text:
              type: string
              description: Axis title text.
              default: ''
            visible:
              type: boolean
              description: 'When `true`, displays the title.'
          additionalProperties: false
      additionalProperties: false
      description: Y axis configuration
    Kibana_HTTP_APIs_visHistogramOperation:
      title: Histogram Operation
      required:
        - operation
        - field
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the histogram.
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        granularity:
          anyOf:
            - minimum: 1
              type: number
              description: 'Target number of histogram buckets (bars). The maximum is controlled by the `histogram:maxBars` advanced setting, which defaults to 1000.'
            - enum:
                - auto
              type: string
          default: auto
        include_empty_rows:
          type: boolean
          description: 'When `true`, includes empty rows in the results.'
          default: true
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - histogram
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visLastValueOperation:
      title: Last Value Operation
      required:
        - field
        - operation
        - time_field
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        multi_value:
          type: boolean
          description: Whether to return all values for multi-value fields. Only affects data table and metric charts; other charts use the last value from the array.
          default: false
        operation:
          enum:
            - last_value
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_field:
          type: string
          description: Time field used to determine document recency
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visLegacyColorByValue:
      title: Legacy color by value
      required:
        - type
        - range
        - steps
        - palette
        - shift
      type: object
      properties:
        palette:
          type: string
          description: The legacy palette name.
        range:
          enum:
            - absolute
            - percentage
          type: string
          description: Determines whether the range is interpreted as absolute or as a percentage of the data.
        shift:
          type: boolean
          description: 'When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`.'
        steps:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - color
            type: object
            properties:
              color:
                type: string
                description: The color to use for this step.
              gte:
                type:
                  - 'null'
                  - number
                description: The lower bound of range from which this color applies (inclusive).
              lt:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (exclusive).
              lte:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (inclusive).
            additionalProperties: false
          description: Array of ordered color steps defining the range each color is applied.
        type:
          enum:
            - legacy_dynamic
          type: string
      additionalProperties: false
      description: Legacy color by value configuration
      deprecated: true
    Kibana_HTTP_APIs_visLegacyColorByValueAbsolute:
      title: Legacy color by value (absolute)
      required:
        - type
        - range
        - steps
        - palette
        - shift
      type: object
      properties:
        palette:
          type: string
          description: The legacy palette name.
        range:
          enum:
            - absolute
          type: string
        shift:
          type: boolean
          description: 'When `true`, shifts the palette colors so they start from a different offset. Defaults to `false`.'
        steps:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - color
            type: object
            properties:
              color:
                type: string
                description: The color to use for this step.
              gte:
                type:
                  - 'null'
                  - number
                description: The lower bound of range from which this color applies (inclusive).
              lt:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (exclusive).
              lte:
                type:
                  - 'null'
                  - number
                description: The upper bound of range to which this color applies (inclusive).
            additionalProperties: false
          description: Array of ordered color steps defining the range each color is applied.
        type:
          enum:
            - legacy_dynamic
          type: string
      additionalProperties: false
      description: Legacy color by absolute value configuration
      deprecated: true
    Kibana_HTTP_APIs_visLegacyMetricChart:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegacyMetricNoESQL'
    Kibana_HTTP_APIs_visLegacyMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visLegacyMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visLegacyMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visLegacyMetricNoESQL:
      title: Legacy Metric Chart (DSL)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          allOf:
            - anyOf:
                - anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
            - type: object
              properties:
                apply_color_to:
                  enum:
                    - value
                    - background
                  type: string
                  description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                color:
                  anyOf:
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValueAbsolute'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValuePalette'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegacyColorByValueAbsolute'
                    - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                  description: Color configuration based on the metric value.
                  default:
                    type: auto
                labels:
                  type: object
                  properties:
                    alignment:
                      enum:
                        - top
                        - bottom
                      type: string
                      description: Label alignment
                      default: top
                  additionalProperties: false
                  description: Labels configuration
                size:
                  anyOf:
                    - enum:
                        - xs
                      type: string
                    - enum:
                        - s
                      type: string
                    - enum:
                        - m
                      type: string
                    - enum:
                        - l
                      type: string
                    - enum:
                        - xl
                      type: string
                    - enum:
                        - xxl
                      type: string
                  description: Font size for the label and value
                  default: m
                values:
                  type: object
                  properties:
                    alignment:
                      enum:
                        - left
                        - center
                        - right
                      type: string
                      description: Value alignment
                      default: left
                  additionalProperties: false
                  description: Values configuration
              additionalProperties: false
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - legacy_metric
          type: string
      additionalProperties: false
      description: Legacy Metric configuration using a data view. Superseded by the Metric chart type.
    Kibana_HTTP_APIs_visLegacyMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visLegacyMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visLegacyMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visLegacyMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visLegacyMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visLegendPosition:
      title: Legend Position
      enum:
        - top
        - bottom
        - left
        - right
      type: string
      description: Legend Position.
      default: right
    Kibana_HTTP_APIs_visLegendSize:
      title: Legend Size
      anyOf:
        - enum:
            - auto
          type: string
        - enum:
            - s
          type: string
        - enum:
            - m
          type: string
        - enum:
            - l
          type: string
        - enum:
            - xl
          type: string
      description: Legend size.
    Kibana_HTTP_APIs_visLegendTruncateAfterLines:
      maximum: 10
      minimum: 1
      type: number
      description: Number of lines before legend items are truncated.
      default: 1
    Kibana_HTTP_APIs_visMetricBreakdownDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visMetricBreakdownFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visMetricBreakdownHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visMetricBreakdownRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visMetricBreakdownTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visMetricChart:
      title: Metric Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricESQL'
      description: 'One or two metric values with optional color coding, trend line, and breakdown by dimension.'
    Kibana_HTTP_APIs_visMetricCompareToBaseline:
      title: Compare To Baseline
      required:
        - to
      type: object
      properties:
        baseline:
          type: number
          description: Baseline value.
          default: 0
        icon:
          type: boolean
          description: 'When `true`, displays the icon for the secondary value.'
          default: true
        palette:
          type: string
          description: 'Color palette name. Accepted values: ''default'', ''elastic_line_optimized'', ''severity'', ''eui_amsterdam'', ''kibana_v7_legacy'', ''elastic_brand_2023''. Defaults to `default`.'
          default: compare_to
        to:
          enum:
            - baseline
          type: string
        value:
          type: boolean
          description: 'When `true`, displays the secondary value.'
          default: true
      additionalProperties: false
    Kibana_HTTP_APIs_visMetricCompareToPrimary:
      title: Compare To Primary
      required:
        - to
      type: object
      properties:
        icon:
          type: boolean
          description: 'When `true`, displays the icon for the secondary value.'
          default: true
        palette:
          type: string
          description: 'Color palette name. Accepted values: ''default'', ''elastic_line_optimized'', ''severity'', ''eui_amsterdam'', ''kibana_v7_legacy'', ''elastic_brand_2023''. Defaults to `default`.'
          default: compare_to
        to:
          enum:
            - primary
          type: string
        value:
          type: boolean
          description: 'When `true`, displays the secondary value.'
          default: true
      additionalProperties: false
    Kibana_HTTP_APIs_visMetricComplementaryBar:
      title: Complementary Bar
      required:
        - type
        - max_value
      type: object
      properties:
        max_value:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        orientation:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiSimpleOrientation'
        type:
          enum:
            - bar
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visMetricComplementaryTrend:
      title: Complementary Trend
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - trend
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visMetricComplementaryViz:
      title: Complementary Visualization
      anyOf:
        - required:
            - type
            - max_value
          type: object
          properties:
            max_value:
              title: Metric Operation
              anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
              description: 'Metric dimension configuration, supporting field-based aggregations (count, sum, average, median, standard deviation, unique count, last value), percentile operations, time-series operations (differences, moving average, cumulative sum, counter rate), and mathematical formulas.'
            orientation:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiSimpleOrientation'
            type:
              enum:
                - bar
              type: string
          additionalProperties: false
        - required:
            - type
          type: object
          properties:
            type:
              enum:
                - trend
              type: string
          additionalProperties: false
      description: 'Secondary visualization displayed behind the primary metric value, either a bar chart (with optional max value) or a trend line.'
    Kibana_HTTP_APIs_visMetricComplementaryVizESQL:
      title: Complementary Visualization
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryBar'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryTrend'
      description: Bar chart or trendline shown behind the primary metric value.
    Kibana_HTTP_APIs_visMetricESQL:
      title: Metric Chart (ES|QL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        breakdown_by:
          required:
            - column
          type: object
          properties:
            collapse_by:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
            column:
              type: string
              description: Column to use
            columns:
              type: number
              description: Number of columns.
              default: 3
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metrics:
          maxItems: 2
          minItems: 1
          type: array
          items:
            anyOf:
              - required:
                  - column
                  - type
                type: object
                properties:
                  apply_color_to:
                    enum:
                      - value
                      - background
                    type: string
                    description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                  background_chart:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryVizESQL'
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    description: Color configuration for the primary metric value or background.
                    default:
                      type: auto
                  column:
                    type: string
                    description: Column to use
                  format:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
                  label:
                    type: string
                    description: Label for the operation
                  subtitle:
                    type: string
                    description: Subtitle below the primary metric value.
                  type:
                    enum:
                      - primary
                    type: string
              - required:
                  - column
                  - type
                type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNoColor'
                    default:
                      type: none
                  column:
                    type: string
                    description: Column to use
                  compare:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToBaseline'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToPrimary'
                    description: Compare the secondary metric to a baseline value or to the primary metric.
                  format:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
                  label:
                    type: string
                    description: Label for the operation
                  type:
                    enum:
                      - secondary
                    type: string
          description: Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - metric
          type: string
      additionalProperties: false
      description: Metric chart configuration for ES|QL queries
    Kibana_HTTP_APIs_visMetricIconConfig:
      title: Icon Configuration
      required:
        - name
      type: object
      properties:
        alignment:
          enum:
            - left
            - right
          type: string
          description: 'Icon alignment. Accepted values: `left`, `right`. Defaults to `right`.'
          default: right
        name:
          anyOf:
            - enum:
                - alert
              type: string
            - enum:
                - asterisk
              type: string
            - enum:
                - bell
              type: string
            - enum:
                - bolt
              type: string
            - enum:
                - bug
              type: string
            - enum:
                - compute
              type: string
            - enum:
                - editor_comment
              type: string
            - enum:
                - flag
              type: string
            - enum:
                - globe
              type: string
            - enum:
                - heart
              type: string
            - enum:
                - map_marker
              type: string
            - enum:
                - pin
              type: string
            - enum:
                - sort_down
              type: string
            - enum:
                - sort_up
              type: string
            - enum:
                - star_empty
              type: string
            - enum:
                - tag
              type: string
            - enum:
                - temperature
              type: string
          description: Icon name
      additionalProperties: false
      description: Icon configuration for the metric chart
    Kibana_HTTP_APIs_visMetricNoESQL:
      title: Metric Chart (DSL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        breakdown_by:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                collapse_by:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                columns:
                  type: number
                  description: Number of columns.
                  default: 3
              additionalProperties: false
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metrics:
          maxItems: 2
          minItems: 1
          type: array
          items:
            anyOf:
              - allOf:
                  - anyOf:
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  - required:
                      - type
                    type: object
                    properties:
                      apply_color_to:
                        enum:
                          - value
                          - background
                        type: string
                        description: 'Color target: `value` colors the metric text, `background` colors the cell or panel background.'
                      background_chart:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricComplementaryViz'
                      color:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorByValue'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                        description: Color configuration for the primary metric value or background.
                        default:
                          type: auto
                      subtitle:
                        type: string
                        description: Subtitle below the primary metric value.
                      type:
                        enum:
                          - primary
                        type: string
              - allOf:
                  - anyOf:
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                      - anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
                  - required:
                      - type
                    type: object
                    properties:
                      color:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visNoColor'
                        default:
                          type: none
                      compare:
                        anyOf:
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToBaseline'
                          - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricCompareToPrimary'
                        description: Compare the secondary metric to a baseline value or to the primary metric.
                      type:
                        enum:
                          - secondary
                        type: string
          description: Metric dimensions to display. The first must be a primary metric; an optional second must be a secondary metric.
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - metric
          type: string
      additionalProperties: false
      description: Metric chart configuration for standard queries
    Kibana_HTTP_APIs_visMetricPrimaryCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visMetricPrimaryCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visMetricPrimaryCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visMetricPrimaryDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visMetricPrimaryFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visMetricPrimaryLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visMetricPrimaryMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visMetricPrimaryPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visMetricPrimaryPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visMetricPrimaryStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visMetricPrimarySumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visMetricPrimaryUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visMetricSecondaryCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visMetricSecondaryCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visMetricSecondaryCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visMetricSecondaryDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visMetricSecondaryFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visMetricSecondaryLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visMetricSecondaryMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visMetricSecondaryPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visMetricSecondaryPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visMetricSecondaryStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visMetricSecondarySumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visMetricSecondaryUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visMetricStyling:
      type: object
      properties:
        density:
          anyOf:
            - enum:
                - compact
              type: string
            - enum:
                - default
              type: string
          description: 'Density preset for the metric chart layout. Use `compact` for a compact layout, or `default` for increased padding, element spacing, and font size.'
          default: default
        icon:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMetricIconConfig'
        primary:
          type: object
          properties:
            labels:
              type: object
              properties:
                alignment:
                  enum:
                    - left
                    - center
                    - right
                  type: string
                  description: 'Horizontal alignment for the title and subtitle text. Accepted values: `left`, `center`, `right`. Defaults to `left`.'
                  default: left
              additionalProperties: false
              description: Labels (title and subtitle) configuration
            position:
              enum:
                - top
                - middle
                - bottom
              type: string
              description: 'Position of the primary metric value (top, middle, or bottom).'
              default: bottom
            value:
              type: object
              properties:
                alignment:
                  enum:
                    - left
                    - center
                    - right
                  type: string
                  description: 'Alignment for the primary metric value. Accepted values: `left`, `center`, `right`. Defaults to `right`.'
                  default: right
                sizing:
                  anyOf:
                    - enum:
                        - auto
                      type: string
                    - enum:
                        - fill
                      type: string
                  description: 'Controls how the primary value text is sized within the panel. ''auto'' selects a font size from predefined breakpoints based on panel height, then shrinks if the text overflows horizontally. ''fill'' scales the text to be as large as possible, filling all available space.'
                  default: auto
              additionalProperties: false
              description: Primary metric value configuration
          additionalProperties: false
        secondary:
          type: object
          properties:
            label:
              type: object
              properties:
                placement:
                  enum:
                    - before
                    - after
                    - tooltip
                  type: string
                  description: 'How the secondary metric name is shown: before the value, after the value, or in a tooltip. Ignored when the label is not visible.'
                  default: before
                visible:
                  type: boolean
                  description: 'When `true`, displays the secondary metric name as its label.'
                  default: false
              additionalProperties: false
            value:
              type: object
              properties:
                alignment:
                  enum:
                    - left
                    - center
                    - right
                  type: string
                  description: 'Alignment for secondary values. Accepted values: `left`, `center`, `right`. Defaults to `right`.'
                  default: right
              additionalProperties: false
              description: Secondary metric value configuration
          additionalProperties: false
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation:
      title: Stats Metric Operation
      required:
        - field
        - operation
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - min
            - max
            - average
            - median
            - standard_deviation
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visMosaicChart:
      title: Mosaic Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicESQL'
      description: Mosaic chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes
    Kibana_HTTP_APIs_visMosaicESQL:
      title: Mosaic Chart (ES|QL)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_breakdown_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              collapse_by:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
              color:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of group breakdown dimensions (minimum 1)
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              collapse_by:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
              color:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicLegend'
        metric:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
          description: 'Metric configuration for ES|QL mode, combining generic options, primary metric options, and column selection'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - mosaic
          type: string
      additionalProperties: false
      description: 'Mosaic chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration'
    Kibana_HTTP_APIs_visMosaicGroupBreakdownByDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visMosaicGroupBreakdownByFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visMosaicGroupBreakdownByHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visMosaicGroupBreakdownByRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visMosaicGroupBreakdownByTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visMosaicGroupByDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visMosaicGroupByFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visMosaicGroupByHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visMosaicGroupByRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visMosaicGroupByTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visMosaicLegend:
      title: Legend
      type: object
      properties:
        nested:
          type: boolean
          description: Show nested legend with hierarchical breakdown levels
          default: false
        position:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendPosition'
        size:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendSize'
        truncate_after_lines:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Legend configuration for mosaic chart appearance and behavior
    Kibana_HTTP_APIs_visMosaicMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visMosaicMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visMosaicMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visMosaicMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visMosaicMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visMosaicMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visMosaicMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visMosaicMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visMosaicMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visMosaicMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visMosaicMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visMosaicMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visMosaicNoESQL:
      title: Mosaic Chart (DSL)
      required:
        - type
        - data_source
        - metric
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_breakdown_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
          description: Array of group breakdown dimensions (minimum 1)
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
                additionalProperties: false
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicLegend'
        metric:
          anyOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visMosaicStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - mosaic
          type: string
      additionalProperties: false
      description: 'Mosaic chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions'
    Kibana_HTTP_APIs_visMosaicStyling:
      title: Mosaic styling
      type: object
      properties:
        values:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visValueDisplay'
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visMovingAverageOperation:
      title: Moving Average Operation
      required:
        - operation
        - of
      type: object
      properties:
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        of:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
        operation:
          enum:
            - moving_average
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
        window:
          type: number
          description: Window
          default: 5
      additionalProperties: false
    Kibana_HTTP_APIs_visMultiFieldKey:
      title: Multi Field Key
      required:
        - type
        - keys
      type: object
      properties:
        keys:
          maxItems: 100
          type: array
          items:
            type: string
        type:
          enum:
            - multi_field_key
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visNoColor:
      title: No Color
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - none
          type: string
      additionalProperties: false
      description: Explicitly disables coloring
    Kibana_HTTP_APIs_visNumericFormat:
      title: Numeric Format
      required:
        - type
      type: object
      properties:
        compact:
          type: boolean
          description: 'When `true`, uses compact notation (for example, 1.2k instead of 1,200). Defaults to `false`.'
          default: false
        decimals:
          type: number
          description: Number of decimal places to display.
          default: 2
        suffix:
          type: string
          description: Suffix appended to the formatted value.
        type:
          enum:
            - number
            - percent
          type: string
          description: 'Value format type: `number` for plain numbers, `percent` for percentages.'
      additionalProperties: false
      description: 'Number or percentage format with optional decimal places, suffix, and compact notation.'
    Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting:
      title: Operation Reduced Time Range Setting
      type: string
      description: Reduced time range
    Kibana_HTTP_APIs_visOperationTimeScaleSetting:
      title: Operation Time Scale Setting
      anyOf:
        - enum:
            - s
          type: string
        - enum:
            - m
          type: string
        - enum:
            - h
          type: string
        - enum:
            - d
          type: string
      description: Time scale
    Kibana_HTTP_APIs_visOperationTimeShiftSetting:
      title: Operation Time Shift Setting
      type: string
      description: Time shift
    Kibana_HTTP_APIs_visPanelFilters:
      maxItems: 100
      type: array
      items:
        $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-filters-schema_asCodeFilterSchema'
      description: Filters applied to the panel
    Kibana_HTTP_APIs_visPercentileOperation:
      title: Percentile Operation
      required:
        - field
        - operation
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - percentile
          type: string
        percentile:
          type: number
          description: Percentile
          default: 95
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visPercentileRanksOperation:
      title: Percentile Ranks Operation
      required:
        - field
        - operation
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - percentile_rank
          type: string
        rank:
          type: number
          description: Percentile Rank
          default: 0
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visPieChart:
      title: Pie Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieESQL'
      description: 'Pie chart state: standard query or ES|QL query'
    Kibana_HTTP_APIs_visPieESQL:
      title: Pie Chart (ES|QL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              collapse_by:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
              color:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              color:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                default:
                  type: auto
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
            description: ES|QL column reference for primary metric
          description: Array of metric configurations (minimum 1)
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - pie
          type: string
      additionalProperties: false
      description: Pie chart configuration for ES|QL queries
    Kibana_HTTP_APIs_visPieGroupByDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visPieGroupByFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visPieGroupByHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visPieGroupByRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visPieGroupByTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visPieLegend:
      title: Legend
      type: object
      properties:
        nested:
          type: boolean
          description: Show nested legend with hierarchical breakdown levels
          default: false
        position:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendPosition'
        size:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendSize'
        truncate_after_lines:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Legend configuration for pie chart
    Kibana_HTTP_APIs_visPieMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visPieMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visPieMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visPieMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visPieMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visPieMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visPieMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visPieMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visPieMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visPieMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visPieMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visPieMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visPieNoESQL:
      title: Pie Chart (DSL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metric configurations (minimum 1)
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPieStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - pie
          type: string
      additionalProperties: false
      description: Pie chart configuration for standard queries
    Kibana_HTTP_APIs_visPieStyling:
      title: Pie chart styling
      type: object
      properties:
        donut_hole:
          anyOf:
            - enum:
                - none
              type: string
            - enum:
                - s
              type: string
            - enum:
                - m
              type: string
            - enum:
                - l
              type: string
          description: 'Donut hole size. Accepted values: `none` (full pie), `s`, `m`, `l`.'
        labels:
          type: object
          properties:
            position:
              anyOf:
                - enum:
                    - inside
                  type: string
                - enum:
                    - outside
                  type: string
              description: 'Slice label position: `inside` or `outside`.'
            visible:
              type: boolean
              description: 'When `true`, displays slice labels.'
          additionalProperties: false
          description: Label configuration for pie chart slice labels inside or outside the pie
        values:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visValueDisplay'
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visRangeKey:
      title: Range Key
      required:
        - type
        - from
        - to
        - ranges
      type: object
      properties:
        from:
          type:
            - number
            - string
        ranges:
          maxItems: 100
          type: array
          items:
            required:
              - from
              - to
              - label
            type: object
            properties:
              from:
                type:
                  - number
                  - string
              label:
                type: string
              to:
                type:
                  - number
                  - string
            additionalProperties: false
        to:
          type:
            - number
            - string
        type:
          enum:
            - range_key
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_visRangesOperation:
      title: Ranges Operation
      required:
        - operation
        - field
        - ranges
      type: object
      properties:
        field:
          type: string
          description: Field to be used for the range.
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - range
          type: string
        ranges:
          maxItems: 100
          type: array
          items:
            type: object
            properties:
              gt:
                type: number
                description: Greater than.
              label:
                type: string
                description: Label.
              lte:
                type: number
                description: Less than or equal to.
      additionalProperties: false
    Kibana_HTTP_APIs_visRegionMapChart:
      title: Region Map
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRegionMapNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRegionMapESQL'
      description: A choropleth map with geographic regions colored by the aggregated metric value.
    Kibana_HTTP_APIs_visRegionMapESQL:
      title: Region Map (ES|QL)
      required:
        - type
        - data_source
        - metric
        - region
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        region:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            ems:
              required:
                - boundaries
                - join
              type: object
              properties:
                boundaries:
                  type: string
                  description: EMS boundaries
                join:
                  type: string
                  description: EMS join field
              additionalProperties: false
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - region_map
          type: string
      additionalProperties: false
      description: 'Region Map configuration using an ES|QL query, mapping metric values to geographic regions by color.'
    Kibana_HTTP_APIs_visRegionMapNoESQL:
      title: Region Map (DSL)
      required:
        - type
        - data_source
        - metric
        - region
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          title: Field Metric or Formula Operation
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFieldMetricOperations'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
          description: Metric dimension using a field-based aggregation or a mathematical formula.
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        region:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                ems:
                  required:
                    - boundaries
                    - join
                  type: object
                  properties:
                    boundaries:
                      type: string
                      description: EMS boundaries
                    join:
                      type: string
                      description: EMS join field
                  additionalProperties: false
              additionalProperties: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - region_map
          type: string
      additionalProperties: false
      description: 'Region Map configuration using a data view, mapping metric values to geographic regions by color.'
    Kibana_HTTP_APIs_visRegionMapRegionDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visRegionMapRegionFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visRegionMapRegionHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visRegionMapRegionRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visRegionMapRegionTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visResponseItem:
      title: Visualization Response
      required:
        - id
        - data
        - meta
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_lensApiConfigLibItemNoESQL'
        id:
          type: string
        meta:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-as-code-meta'
      additionalProperties: false
    Kibana_HTTP_APIs_visStaticColor:
      title: Static Color
      required:
        - type
        - color
      type: object
      properties:
        color:
          type: string
          description: The static color to be used for all values.
        type:
          enum:
            - static
          type: string
      additionalProperties: false
      description: Fixed color for all values in the dimension.
    Kibana_HTTP_APIs_visStaticOperationDefinition:
      title: Static Operation Definition
      required:
        - operation
      type: object
      properties:
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - static_value
          type: string
        value:
          type: number
          description: Static value
          default: 100
      additionalProperties: false
    Kibana_HTTP_APIs_visSumMetricOperation:
      title: Sum Metric Operation
      required:
        - field
        - operation
      type: object
      properties:
        empty_as_null:
          type: boolean
          description: 'When `true`, treats empty buckets as null instead of zero.'
          default: false
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - sum
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visTagcloudChart:
      title: Tag Cloud Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTagcloudNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTagcloudESQL'
      description: A word cloud with terms sized by metric value.
    Kibana_HTTP_APIs_visTagcloudESQL:
      title: Tag Cloud Chart (ES|QL)
      required:
        - type
        - data_source
        - metric
        - tag_by
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTagcloudStyling'
        tag_by:
          required:
            - column
          type: object
          properties:
            color:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - tag_cloud
          type: string
      additionalProperties: false
      description: Tag Cloud configuration using an ES|QL query.
    Kibana_HTTP_APIs_visTagcloudMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visTagcloudMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visTagcloudMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visTagcloudMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visTagcloudMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visTagcloudMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visTagcloudMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visTagcloudMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visTagcloudMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visTagcloudMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visTagcloudMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visTagcloudMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visTagcloudNoESQL:
      title: Tag Cloud Chart (DSL)
      required:
        - type
        - data_source
        - metric
        - tag_by
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        metric:
          anyOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTagcloudStyling'
        tag_by:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                color:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              additionalProperties: false
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - tag_cloud
          type: string
      additionalProperties: false
      description: Tag Cloud configuration using a data view.
    Kibana_HTTP_APIs_visTagcloudStyling:
      title: Tag cloud styling
      type: object
      properties:
        caption:
          type: object
          properties:
            visible:
              type: boolean
              description: 'When `true`, displays the caption.'
              default: true
          additionalProperties: false
          description: Caption configuration representing the metric and the tag_by operations labels
        font_size:
          type: object
          properties:
            max:
              maximum: 120
              type: number
              description: Maximum font size.
              default: 72
            min:
              minimum: 1
              type: number
              description: Minimum font size.
              default: 18
          additionalProperties: false
          description: Font size range for tags.
        orientation:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiOrientation'
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visTagcloudTagDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visTagcloudTagFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visTagcloudTagHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visTagcloudTagRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visTagcloudTagTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visTermsOperation:
      title: Terms Operation
      required:
        - operation
        - fields
      type: object
      properties:
        excludes:
          required:
            - values
          type: object
          properties:
            as_regex:
              type: boolean
              description: 'When `true`, treats the values as regular expressions.'
            values:
              anyOf:
                - maxItems: 100
                  type: array
                  items:
                    type: string
                - maxItems: 100
                  type: array
                  items:
                    type: number
              description: Values to exclude.
          additionalProperties: false
        fields:
          maxItems: 4
          minItems: 1
          type: array
          items:
            type: string
            description: Fields to be used for the terms.
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        includes:
          required:
            - values
          type: object
          properties:
            as_regex:
              type: boolean
              description: 'When `true`, treats the values as regular expressions.'
            values:
              anyOf:
                - maxItems: 100
                  type: array
                  items:
                    type: string
                - maxItems: 100
                  type: array
                  items:
                    type: number
              description: Values to include.
          additionalProperties: false
        increase_accuracy:
          type: boolean
          description: 'When `true`, increases accuracy at the cost of performance.'
        label:
          type: string
          description: Label for the operation
        limit:
          type: number
          description: Number of terms to return.
          default: 5
        operation:
          enum:
            - terms
          type: string
        other_bucket:
          required:
            - include_documents_without_field
          type: object
          properties:
            include_documents_without_field:
              type: boolean
              description: 'When `true`, includes documents that do not have the specified field.'
          additionalProperties: false
        rank_by:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByAlphabetical'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByRare'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankBySignificant'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByMetric'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByCustomOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByCustomCountOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByPercentileOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsRankByPercentileRankOperation'
      additionalProperties: false
    Kibana_HTTP_APIs_visTermsRankByAlphabetical:
      title: Terms Rank By Alphabetical
      required:
        - type
        - direction
      type: object
      properties:
        direction:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
        type:
          enum:
            - alphabetical
          type: string
      additionalProperties: false
      description: Terms ranked alphabetically.
    Kibana_HTTP_APIs_visTermsRankByAlphabeticalDirection:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
    Kibana_HTTP_APIs_visTermsRankByCustomCountOperation:
      title: Terms Rank By Custom Count Operation
      required:
        - type
        - direction
        - operation
      type: object
      properties:
        direction:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
        field:
          type: string
          description: Numeric field to be used for the custom operation.
        operation:
          enum:
            - count
          type: string
        type:
          enum:
            - custom
          type: string
      additionalProperties: false
      description: 'Terms ranked by count, either of all documents or of a specific field.'
    Kibana_HTTP_APIs_visTermsRankByCustomDirection:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
    Kibana_HTTP_APIs_visTermsRankByCustomOperation:
      title: Terms Rank By Custom Operation
      required:
        - type
        - field
        - direction
        - operation
      type: object
      properties:
        direction:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
        field:
          type: string
          description: Numeric field to be used for the custom operation.
        operation:
          enum:
            - min
            - max
            - average
            - median
            - standard_deviation
            - unique_count
            - sum
            - last_value
          type: string
        type:
          enum:
            - custom
          type: string
      additionalProperties: false
      description: Terms ranked by custom operation.
    Kibana_HTTP_APIs_visTermsRankByMetric:
      title: Terms Rank By Metric
      required:
        - type
        - direction
      type: object
      properties:
        direction:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
        metric_index:
          minimum: 0
          type: number
          description: Zero-based index into the metrics array identifying which metric to rank by.
          default: 0
        type:
          enum:
            - metric
          type: string
      additionalProperties: false
      description: Terms ranked by a linked metric.
    Kibana_HTTP_APIs_visTermsRankByMetricDirection:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
    Kibana_HTTP_APIs_visTermsRankByPercentileOperation:
      title: Terms Rank By Percentile Operation
      required:
        - type
        - field
        - direction
        - operation
      type: object
      properties:
        direction:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
        field:
          type: string
          description: Numeric field to be used for the custom operation.
        operation:
          enum:
            - percentile
          type: string
        percentile:
          type: number
          description: The percentile threshold (0–100) at which to compute the field value used for ranking terms.
          default: 95
        type:
          enum:
            - custom
          type: string
      additionalProperties: false
      description: 'Terms ranked by a percentile of a numeric field, for example the 95th percentile of response time.'
    Kibana_HTTP_APIs_visTermsRankByPercentileRankOperation:
      title: Terms Rank By Percentile Rank Operation
      required:
        - type
        - field
        - direction
        - operation
      type: object
      properties:
        direction:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiDirection'
        field:
          type: string
          description: Numeric field to be used for the custom operation.
        operation:
          enum:
            - percentile_rank
          type: string
        rank:
          type: number
          description: The numeric value for which to compute the percentile rank (the percentage of field values at or below this value).
          default: 0
        type:
          enum:
            - custom
          type: string
      additionalProperties: false
      description: 'Terms ranked by the percentile rank of a single value: the proportion of field values at or below that value.'
    Kibana_HTTP_APIs_visTermsRankByRare:
      title: Terms Rank By Rarity
      required:
        - type
        - max
      type: object
      properties:
        max:
          type: number
          description: Maximum number of rare terms to include.
        type:
          enum:
            - rare
          type: string
      additionalProperties: false
      description: Terms ranked by rarity.
    Kibana_HTTP_APIs_visTermsRankBySignificant:
      title: Terms Rank By Significance
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - significant
          type: string
      additionalProperties: false
      description: Terms ranked by significance.
    Kibana_HTTP_APIs_visTreemapChart:
      title: Treemap Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapESQL'
      description: Treemap chart configuration schema supporting both data source queries (non-ES|QL) and ES|QL query modes
    Kibana_HTTP_APIs_visTreemapESQL:
      title: Treemap Chart (ES|QL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              collapse_by:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
              color:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              color:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                default:
                  type: auto
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of metric configurations (minimum 1)
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - treemap
          type: string
      additionalProperties: false
      description: 'Treemap chart configuration schema for ES|QL queries, defining metrics and breakdown dimensions using column-based configuration'
    Kibana_HTTP_APIs_visTreemapGroupByDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visTreemapGroupByFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visTreemapGroupByHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visTreemapGroupByRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visTreemapGroupByTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visTreemapLegend:
      title: Legend
      type: object
      properties:
        nested:
          type: boolean
          description: Show nested legend with hierarchical breakdown levels
          default: false
        position:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendPosition'
        size:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendSize'
        truncate_after_lines:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Configuration for the treemap chart legend appearance and behavior
    Kibana_HTTP_APIs_visTreemapMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visTreemapMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visTreemapMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visTreemapMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visTreemapMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visTreemapMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visTreemapMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visTreemapMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visTreemapMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visTreemapMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visTreemapMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visTreemapMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visTreemapNoESQL:
      title: Treemap Chart (DSL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metric configurations (minimum 1)
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visTreemapStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - treemap
          type: string
      additionalProperties: false
      description: 'Treemap chart configuration schema for data source queries (non-ES|QL mode), defining metrics and breakdown dimensions'
    Kibana_HTTP_APIs_visTreemapStyling:
      title: Treemap styling
      type: object
      properties:
        labels:
          type: object
          properties:
            visible:
              type: boolean
              description: Show category labels
          additionalProperties: false
          description: Labels configuration
        values:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visValueDisplay'
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visUnassignedColorSchema:
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorFromPalette'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorCode'
      description: The color to use for unassigned values.
    Kibana_HTTP_APIs_visUniqueCountMetricOperation:
      title: Unique Count Metric Operation
      required:
        - field
        - operation
      type: object
      properties:
        empty_as_null:
          type: boolean
          description: 'When `true`, treats empty buckets as null instead of zero.'
          default: false
        field:
          type: string
          description: Field to be used for the metric
        filter:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        format:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
        label:
          type: string
          description: Label for the operation
        operation:
          enum:
            - unique_count
          type: string
        reduced_time_range:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationReducedTimeRangeSetting'
        time_scale:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeScaleSetting'
        time_shift:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visOperationTimeShiftSetting'
      additionalProperties: false
    Kibana_HTTP_APIs_visValueDisplay:
      type: object
      properties:
        mode:
          anyOf:
            - enum:
                - absolute
              type: string
            - enum:
                - percentage
              type: string
          description: How to format values when visible.
        percent_decimals:
          maximum: 10
          minimum: 0
          type: number
          description: Decimal places for percentage display (0-10)
          default: 2
        visible:
          type: boolean
          description: Show metric values on the chart
      additionalProperties: false
      description: Configure the visibility and the format of the values rendered on each chart partition section
    Kibana_HTTP_APIs_visWaffleChart:
      title: Waffle Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleESQL'
      description: 'Waffle chart configuration: DSL or ES|QL query based'
    Kibana_HTTP_APIs_visWaffleESQL:
      title: Waffle Chart (ES|QL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              collapse_by:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
              color:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of ES|QL breakdown columns (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            required:
              - column
            type: object
            properties:
              color:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                default:
                  type: auto
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
          description: Array of metric configurations (minimum 1)
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - waffle
          type: string
      additionalProperties: false
      description: Waffle chart configuration for ES|QL queries
    Kibana_HTTP_APIs_visWaffleGroupByDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visWaffleGroupByFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visWaffleGroupByHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visWaffleGroupByRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visWaffleGroupByTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visWaffleLegend:
      title: Legend
      type: object
      properties:
        position:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendPosition'
        size:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendSize'
        truncate_after_lines:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
        values:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - absolute
            type: string
            description: 'Legend value display mode: absolute (show raw metric values in legend)'
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Legend configuration for waffle chart
    Kibana_HTTP_APIs_visWaffleMetricCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visWaffleMetricCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visWaffleMetricCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visWaffleMetricDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visWaffleMetricFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visWaffleMetricLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visWaffleMetricMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visWaffleMetricPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visWaffleMetricPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visWaffleMetricStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visWaffleMetricSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visWaffleMetricUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visWaffleNoESQL:
      title: Waffle Chart (DSL)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metric configurations (minimum 1)
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - waffle
          type: string
      additionalProperties: false
      description: Waffle chart configuration for standard queries
    Kibana_HTTP_APIs_visWaffleStyling:
      title: Waffle styling
      type: object
      properties:
        values:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visValueDisplay'
      additionalProperties: false
      description: Visual chart styling options
    Kibana_HTTP_APIs_visXyAnnotationByRefLayer:
      title: Annotation Layer (By Reference)
      required:
        - type
        - group_id
      type: object
      properties:
        group_id:
          type: string
          description: ID of the linked annotation group from the library
        type:
          enum:
            - annotation_group
          type: string
      additionalProperties: false
      description: Reference to a library annotation group
    Kibana_HTTP_APIs_visXyAnnotationLayerNoESQL:
      title: Annotation Layer (DSL)
      required:
        - type
        - events
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        events:
          maxItems: 100
          minItems: 1
          type: array
          items:
            anyOf:
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationQuery'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationManualEvent'
              - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationManualRange'
          description: Array of annotation configurations
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        type:
          enum:
            - annotations
          type: string
      additionalProperties: false
      description: 'Layer containing annotations (query-based, points, and ranges)'
    Kibana_HTTP_APIs_visXyAnnotationManualEvent:
      required:
        - type
        - timestamp
      type: object
      properties:
        color:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
          default:
            type: auto
        icon:
          anyOf:
            - enum:
                - asterisk
              type: string
            - enum:
                - alert
              type: string
            - enum:
                - bell
              type: string
            - enum:
                - bolt
              type: string
            - enum:
                - bug
              type: string
            - enum:
                - circle
              type: string
            - enum:
                - editor_comment
              type: string
            - enum:
                - flag
              type: string
            - enum:
                - heart
              type: string
            - enum:
                - map_marker
              type: string
            - enum:
                - pin_filled
              type: string
            - enum:
                - star_empty
              type: string
            - enum:
                - star_filled
              type: string
            - enum:
                - tag
              type: string
            - enum:
                - triangle
              type: string
          description: Icon to display at the annotation point
        label:
          type: string
          description: Label text for the annotation
        line:
          required:
            - stroke_width
            - stroke_dash
          type: object
          properties:
            stroke_dash:
              anyOf:
                - enum:
                    - solid
                  type: string
                - enum:
                    - dashed
                  type: string
                - enum:
                    - dotted
                  type: string
              description: Vertical line style
            stroke_width:
              maximum: 10
              minimum: 1
              type: number
              description: Vertical line width in pixels
          additionalProperties: false
          description: Vertical line configuration for point annotation
        text:
          required:
            - visible
          type: object
          properties:
            visible:
              type: boolean
              description: Show text label on the annotation
          additionalProperties: false
          description: Annotation text label visibility
        timestamp:
          anyOf:
            - type: number
              description: Unix timestamp in milliseconds
            - type: string
              description: ISO date string
        type:
          enum:
            - point
          type: string
        visible:
          type: boolean
          description: Show the annotation
      additionalProperties: false
      description: Manual point annotation at specific timestamp
    Kibana_HTTP_APIs_visXyAnnotationManualRange:
      required:
        - type
        - interval
      type: object
      properties:
        color:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
          default:
            type: auto
        fill:
          anyOf:
            - enum:
                - inside
              type: string
            - enum:
                - outside
              type: string
          description: Fill direction for range
          default: inside
        interval:
          required:
            - from
            - to
          type: object
          properties:
            from:
              anyOf:
                - type: number
                  description: Unix timestamp in milliseconds
                - type: string
                  description: ISO date string
            to:
              anyOf:
                - type: number
                  description: Unix timestamp in milliseconds
                - type: string
                  description: ISO date string
          additionalProperties: false
          description: Time range for annotation
        label:
          type: string
          description: Label text for the annotation
        type:
          enum:
            - range
          type: string
        visible:
          type: boolean
          description: Show the annotation
      additionalProperties: false
      description: Manual range annotation spanning time interval
    Kibana_HTTP_APIs_visXyAnnotationQuery:
      required:
        - type
        - query
        - time_field
      type: object
      properties:
        color:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
          default:
            type: auto
        extra_fields:
          maxItems: 100
          type: array
          items:
            type: string
            description: Additional field to include in tooltip
          description: Additional fields for annotation tooltip
        icon:
          anyOf:
            - enum:
                - asterisk
              type: string
            - enum:
                - alert
              type: string
            - enum:
                - bell
              type: string
            - enum:
                - bolt
              type: string
            - enum:
                - bug
              type: string
            - enum:
                - circle
              type: string
            - enum:
                - editor_comment
              type: string
            - enum:
                - flag
              type: string
            - enum:
                - heart
              type: string
            - enum:
                - map_marker
              type: string
            - enum:
                - pin_filled
              type: string
            - enum:
                - star_empty
              type: string
            - enum:
                - star_filled
              type: string
            - enum:
                - tag
              type: string
            - enum:
                - triangle
              type: string
          description: Icon to display at the annotation point
        label:
          type: string
          description: Label text for the annotation
        line:
          required:
            - stroke_width
            - stroke_dash
          type: object
          properties:
            stroke_dash:
              anyOf:
                - enum:
                    - solid
                  type: string
                - enum:
                    - dashed
                  type: string
                - enum:
                    - dotted
                  type: string
              description: Vertical line style
            stroke_width:
              maximum: 10
              minimum: 1
              type: number
              description: Vertical line width in pixels
          additionalProperties: false
          description: Vertical line configuration for point annotation
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        text:
          required:
            - visible
          type: object
          properties:
            field:
              type: string
              description: Field name for text label source
            visible:
              type: boolean
              description: Show text label on the annotation
          additionalProperties: false
          description: Annotation text label configuration
        time_field:
          type: string
          description: Field containing the timestamp
        type:
          enum:
            - query
          type: string
        visible:
          type: boolean
          description: Show the annotation
      additionalProperties: false
      description: Annotation from query results matching a filter
    Kibana_HTTP_APIs_visXyBreakdownDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visXyBreakdownFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visXyBreakdownHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visXyBreakdownRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visXyBreakdownTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visXyChart:
      title: XY Chart
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyChartNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyChartESQL'
      description: XY chart configuration
    Kibana_HTTP_APIs_visXyChartESQL:
      title: XY Chart (ES|QL)
      required:
        - type
        - layers
      type: object
      properties:
        axis:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiXyAxisConfig'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        layers:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLayerESQL'
          description: ES|QL chart layers
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegend'
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - xy
          type: string
      additionalProperties: false
      description: XY chart configuration for ES|QL queries
    Kibana_HTTP_APIs_visXyChartNoESQL:
      title: XY Chart (DSL)
      required:
        - type
        - layers
      type: object
      properties:
        axis:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiXyAxisConfig'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        layers:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLayersNoESQL'
          description: Chart layers
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegend'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStyling'
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - xy
          type: string
      additionalProperties: false
      description: XY chart configuration for DSL queries
    Kibana_HTTP_APIs_visXyFitting:
      required:
        - type
      type: object
      properties:
        emphasize:
          type: boolean
          description: Visually distinguish fitted segments with a dashed line style and reduced area opacity
        extend:
          anyOf:
            - enum:
                - none
              type: string
            - enum:
                - zero
              type: string
            - enum:
                - nearest
              type: string
          description: How to render line and area edges when data does not cover the full X domain
        type:
          anyOf:
            - enum:
                - none
              type: string
            - enum:
                - zero
              type: string
            - enum:
                - linear
              type: string
            - enum:
                - carry
              type: string
            - enum:
                - lookahead
              type: string
            - enum:
                - average
              type: string
            - enum:
                - nearest
              type: string
          description: Fitting function type for missing data
      additionalProperties: false
      description: Missing data interpolation configuration for line and area series
    Kibana_HTTP_APIs_visXyLayerESQL:
      title: Layer (ES|QL)
      required:
        - data_source
        - type
        - y
      type: object
      properties:
        breakdown_by:
          required:
            - column
          type: object
          properties:
            collapse_by:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
            color:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
          description: ES|QL column for breakdown
        data_source:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_esqlDataSource'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        type:
          anyOf:
            - enum:
                - area
              type: string
            - enum:
                - area_percentage
              type: string
            - enum:
                - area_stacked
              type: string
            - enum:
                - bar
              type: string
            - enum:
                - bar_horizontal
              type: string
            - enum:
                - bar_horizontal_stacked
              type: string
            - enum:
                - bar_horizontal_percentage
              type: string
            - enum:
                - bar_percentage
              type: string
            - enum:
                - bar_stacked
              type: string
            - enum:
                - line
              type: string
          description: Chart type for the data layer
        x:
          required:
            - column
          type: object
          properties:
            column:
              type: string
              description: Column to use
            format:
              $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
            label:
              type: string
              description: Label for the operation
          additionalProperties: false
        y:
          maxItems: 100
          type: array
          items:
            required:
              - column
            type: object
            properties:
              axis:
                anyOf:
                  - enum:
                      - y
                    type: string
                  - enum:
                      - y2
                    type: string
                description: 'The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side.'
                default: y
              color:
                anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                default:
                  type: auto
              column:
                type: string
                description: Column to use
              format:
                $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormatType'
              label:
                type: string
                description: Label for the operation
            additionalProperties: false
            description: ES|QL column for Y-axis metric
          description: Array of ES|QL columns for Y-axis metrics
      additionalProperties: false
      description: Data layer for ES|QL queries with column references
    Kibana_HTTP_APIs_visXyLayerNoESQL:
      title: Layer (DSL)
      required:
        - data_source
        - type
        - y
      type: object
      properties:
        breakdown_by:
          allOf:
            - anyOf:
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
            - type: object
              properties:
                aggregate_first:
                  type: boolean
                  description: 'When `true`, aggregates data before splitting into series. Defaults to `false`.'
                collapse_by:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                color:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
              additionalProperties: false
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        type:
          anyOf:
            - enum:
                - area
              type: string
            - enum:
                - area_percentage
              type: string
            - enum:
                - area_stacked
              type: string
            - enum:
                - bar
              type: string
            - enum:
                - bar_horizontal
              type: string
            - enum:
                - bar_horizontal_stacked
              type: string
            - enum:
                - bar_horizontal_percentage
              type: string
            - enum:
                - bar_percentage
              type: string
            - enum:
                - bar_stacked
              type: string
            - enum:
                - line
              type: string
          description: Chart type for the data layer
        x:
          anyOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
        y:
          maxItems: 100
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  axis:
                    anyOf:
                      - enum:
                          - y
                        type: string
                      - enum:
                          - y2
                        type: string
                    description: 'The Y axis this metric is plotted on. Values match the root axis configuration keys (axis.y, axis.y2). If omitted, defaults to the Y axis start (leading) side.'
                    default: y
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metrics to display on Y-axis
      additionalProperties: false
      description: Data layer for standard queries with metrics and buckets
    Kibana_HTTP_APIs_visXyLayersESQL:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLayerESQL'
    Kibana_HTTP_APIs_visXyLayersNoESQL:
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLayerNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyReferenceLineLayerNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationLayerNoESQL'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyAnnotationByRefLayer'
      description: XY chart layer types for DSL queries
    Kibana_HTTP_APIs_visXyLegend:
      title: Legend
      anyOf:
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegendOutsideHorizontal'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegendOutsideVertical'
        - $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegendInside'
      description: Legend configuration for XY chart
    Kibana_HTTP_APIs_visXyLegendInside:
      title: Inside
      required:
        - placement
      type: object
      properties:
        columns:
          maximum: 5
          minimum: 1
          type: number
          description: Number of legend columns
        layout:
          required:
            - type
          type: object
          properties:
            truncate:
              type: object
              properties:
                enabled:
                  type: boolean
                  description: Enable truncation of legend items
                max_lines:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
              additionalProperties: false
            type:
              enum:
                - grid
              type: string
          additionalProperties: false
        placement:
          enum:
            - inside
          type: string
        position:
          enum:
            - top_left
            - top_right
            - bottom_left
            - bottom_right
          type: string
          description: Legend position inside the chart
        series_header:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegendSeriesHeader'
        statistics:
          maxItems: 17
          type: array
          items:
            anyOf:
              - enum:
                  - min
                type: string
              - enum:
                  - max
                type: string
              - enum:
                  - avg
                type: string
              - enum:
                  - median
                type: string
              - enum:
                  - range
                type: string
              - enum:
                  - last_value
                type: string
              - enum:
                  - last_non_null_value
                type: string
              - enum:
                  - first_value
                type: string
              - enum:
                  - first_non_null_value
                type: string
              - enum:
                  - difference
                type: string
              - enum:
                  - difference_percentage
                type: string
              - enum:
                  - count
                type: string
              - enum:
                  - total
                type: string
              - enum:
                  - standard_deviation
                type: string
              - enum:
                  - variance
                type: string
              - enum:
                  - distinct_count
                type: string
              - enum:
                  - current_and_last_value
                type: string
            description: Statistical functions that can be displayed in chart legend for data series
          description: Statistics to display in legend
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Inside legend
    Kibana_HTTP_APIs_visXyLegendOutsideHorizontal:
      title: Outside horizontal
      type: object
      properties:
        layout:
          anyOf:
            - required:
                - type
              type: object
              properties:
                truncate:
                  type: object
                  properties:
                    enabled:
                      type: boolean
                      description: Enable truncation of legend items
                    max_lines:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
                  additionalProperties: false
                type:
                  enum:
                    - grid
                  type: string
              additionalProperties: false
            - required:
                - type
              type: object
              properties:
                type:
                  enum:
                    - list
                  type: string
              additionalProperties: false
        placement:
          enum:
            - outside
          type: string
        position:
          enum:
            - top
            - bottom
          type: string
        series_header:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegendSeriesHeader'
        statistics:
          maxItems: 17
          type: array
          items:
            anyOf:
              - enum:
                  - min
                type: string
              - enum:
                  - max
                type: string
              - enum:
                  - avg
                type: string
              - enum:
                  - median
                type: string
              - enum:
                  - range
                type: string
              - enum:
                  - last_value
                type: string
              - enum:
                  - last_non_null_value
                type: string
              - enum:
                  - first_value
                type: string
              - enum:
                  - first_non_null_value
                type: string
              - enum:
                  - difference
                type: string
              - enum:
                  - difference_percentage
                type: string
              - enum:
                  - count
                type: string
              - enum:
                  - total
                type: string
              - enum:
                  - standard_deviation
                type: string
              - enum:
                  - variance
                type: string
              - enum:
                  - distinct_count
                type: string
              - enum:
                  - current_and_last_value
                type: string
            description: Statistical functions that can be displayed in chart legend for data series
          description: Statistics to display in legend
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Outside legend positioned horizontal (top/bottom) of the chart
    Kibana_HTTP_APIs_visXyLegendOutsideVertical:
      title: Outside vertical
      type: object
      properties:
        layout:
          required:
            - type
          type: object
          properties:
            truncate:
              type: object
              properties:
                enabled:
                  type: boolean
                  description: Enable truncation of legend items
                max_lines:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendTruncateAfterLines'
              additionalProperties: false
            type:
              enum:
                - grid
              type: string
          additionalProperties: false
        placement:
          enum:
            - outside
          type: string
        position:
          enum:
            - left
            - right
          type: string
        series_header:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegendSeriesHeader'
        size:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visLegendSize'
        statistics:
          maxItems: 17
          type: array
          items:
            anyOf:
              - enum:
                  - min
                type: string
              - enum:
                  - max
                type: string
              - enum:
                  - avg
                type: string
              - enum:
                  - median
                type: string
              - enum:
                  - range
                type: string
              - enum:
                  - last_value
                type: string
              - enum:
                  - last_non_null_value
                type: string
              - enum:
                  - first_value
                type: string
              - enum:
                  - first_non_null_value
                type: string
              - enum:
                  - difference
                type: string
              - enum:
                  - difference_percentage
                type: string
              - enum:
                  - count
                type: string
              - enum:
                  - total
                type: string
              - enum:
                  - standard_deviation
                type: string
              - enum:
                  - variance
                type: string
              - enum:
                  - distinct_count
                type: string
              - enum:
                  - current_and_last_value
                type: string
            description: Statistical functions that can be displayed in chart legend for data series
          description: Statistics to display in legend
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Legend visibility.
      additionalProperties: false
      description: Outside legend positioned vertical (left/right) of the chart
    Kibana_HTTP_APIs_visXyLegendSeriesHeader:
      type: object
      properties:
        text:
          type: string
          description: Legend table series header text.
        visible:
          type: boolean
          description: 'When true, shows the legend table series header.'
      additionalProperties: false
      description: Legend table series header configuration.
    Kibana_HTTP_APIs_visXyReferenceLineLayerNoESQL:
      title: Reference Line Layer (DSL)
      required:
        - data_source
        - type
        - thresholds
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        thresholds:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  axis:
                    anyOf:
                      - enum:
                          - x
                        type: string
                      - enum:
                          - y
                        type: string
                      - enum:
                          - y2
                        type: string
                    description: 'The axis this reference line is drawn on. Values match the root axis configuration keys. If omitted, defaults to the primary Y axis.'
                    default: y
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
                  fill:
                    anyOf:
                      - enum:
                          - above
                        type: string
                      - enum:
                          - below
                        type: string
                    description: Fill direction for reference line
                  icon:
                    anyOf:
                      - enum:
                          - asterisk
                        type: string
                      - enum:
                          - alert
                        type: string
                      - enum:
                          - bell
                        type: string
                      - enum:
                          - bolt
                        type: string
                      - enum:
                          - bug
                        type: string
                      - enum:
                          - circle
                        type: string
                      - enum:
                          - editor_comment
                        type: string
                      - enum:
                          - flag
                        type: string
                      - enum:
                          - heart
                        type: string
                      - enum:
                          - map_marker
                        type: string
                      - enum:
                          - pin_filled
                        type: string
                      - enum:
                          - star_empty
                        type: string
                      - enum:
                          - star_filled
                        type: string
                      - enum:
                          - tag
                        type: string
                      - enum:
                          - triangle
                        type: string
                    description: Icon to display on the reference line
                  position:
                    anyOf:
                      - enum:
                          - auto
                        type: string
                      - enum:
                          - left
                        type: string
                      - enum:
                          - right
                        type: string
                    description: Position of the icon and label relative to the reference line
                  stroke_dash:
                    anyOf:
                      - enum:
                          - solid
                        type: string
                      - enum:
                          - dashed
                        type: string
                      - enum:
                          - dotted
                        type: string
                    description: Line style
                  stroke_width:
                    maximum: 10
                    minimum: 1
                    type: number
                    description: Line width in pixels
                  text:
                    required:
                      - visible
                    type: object
                    properties:
                      visible:
                        type: boolean
                        description: Show text label on the reference line
                    additionalProperties: false
                    description: Reference line text label configuration
          description: Array of reference line thresholds
        type:
          enum:
            - reference_lines
          type: string
      additionalProperties: false
      description: Reference line layer for standard queries
    Kibana_HTTP_APIs_visXyRefLineCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visXyRefLineFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visXyRefLineLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visXyRefLinePercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visXyRefLinePercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visXyRefLineStatic:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticOperationDefinition'
    Kibana_HTTP_APIs_visXyRefLineStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visXyRefLineSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visXyRefLineUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_visXyStyling:
      type: object
      properties:
        areas:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStylingAreas'
        bars:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStylingBars'
        fitting:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyFitting'
        interpolation:
          anyOf:
            - enum:
                - linear
              type: string
            - enum:
                - smooth
              type: string
            - enum:
                - stepped
              type: string
          description: Curve interpolation method for line and area series
          default: linear
        overlays:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStylingOverlays'
        points:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStylingPoints'
      additionalProperties: false
      description: Visual styling options for the chart
    Kibana_HTTP_APIs_visXyStylingAreas:
      type: object
      properties:
        fill:
          enum:
            - solid
            - gradient
          type: string
          description: 'Area fill type: solid or gradient. Defaults to solid.'
          default: solid
          x-state: Added in 9.6.0
        fill_opacity:
          maximum: 2
          minimum: 0
          type: number
          description: 'Area fill opacity (0-1 typical, max 2 for legacy)'
          default: 0.3
      additionalProperties: false
      description: Area-specific rendering settings
    Kibana_HTTP_APIs_visXyStylingBars:
      type: object
      properties:
        data_labels:
          type: object
          properties:
            visible:
              type: boolean
              description: Display value labels on bar data points
              default: false
          additionalProperties: false
          description: Data label configuration for bar series
        minimum_height:
          minimum: 0
          type: number
          description: Minimum bar height in pixels
          default: 1
      additionalProperties: false
      description: Bar-specific rendering settings
    Kibana_HTTP_APIs_visXyStylingOverlays:
      type: object
      properties:
        current_time_marker:
          type: object
          properties:
            visible:
              type: boolean
              description: Show current time marker line
              default: false
          additionalProperties: false
          description: Current time marker configuration
        partial_buckets:
          type: object
          properties:
            visible:
              type: boolean
              description: Show partial bucket indicators at time range edges
              default: false
          additionalProperties: false
          description: Partial (incomplete) bucket indicator configuration
      additionalProperties: false
      description: Visual overlays drawn on top of the chart canvas
    Kibana_HTTP_APIs_visXyStylingPoints:
      type: object
      properties:
        visibility:
          anyOf:
            - enum:
                - auto
              type: string
            - enum:
                - visible
              type: string
            - enum:
                - hidden
              type: string
          description: Data point marker visibility on line and area series
          default: auto
      additionalProperties: false
      description: Data point marker settings for line and area series
    Kibana_HTTP_APIs_visXyXDateHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
    Kibana_HTTP_APIs_visXyXFilters:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
    Kibana_HTTP_APIs_visXyXHistogram:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
    Kibana_HTTP_APIs_visXyXRanges:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
    Kibana_HTTP_APIs_visXyXTerms:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
    Kibana_HTTP_APIs_visXyYCounterRate:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
    Kibana_HTTP_APIs_visXyYCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
    Kibana_HTTP_APIs_visXyYCumulativeSum:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
    Kibana_HTTP_APIs_visXyYDifferences:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
    Kibana_HTTP_APIs_visXyYFormula:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
    Kibana_HTTP_APIs_visXyYLastValue:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
    Kibana_HTTP_APIs_visXyYMovingAverage:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
    Kibana_HTTP_APIs_visXyYPercentile:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
    Kibana_HTTP_APIs_visXyYPercentileRanks:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
    Kibana_HTTP_APIs_visXyYStatsMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
    Kibana_HTTP_APIs_visXyYSumMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
    Kibana_HTTP_APIs_visXyYUniqueCountMetric:
      $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
    Kibana_HTTP_APIs_waffleLibItemNoESQL:
      title: Waffle Chart (library)
      required:
        - type
        - data_source
        - metrics
      type: object
      properties:
        data_source:
          oneOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
          discriminator:
            propertyName: type
            mapping:
              data_view_reference: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-reference-schema'
              data_view_spec: '#/components/schemas/Kibana_HTTP_APIs_kbn-data-view-spec-schema'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        group_by:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDateHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visTermsOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visHistogramOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visRangesOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFiltersOperation'
              - type: object
                properties:
                  collapse_by:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visCollapseBy'
                  color:
                    $ref: '#/components/schemas/Kibana_HTTP_APIs_visColorMapping'
          description: Array of breakdown dimensions (minimum 1)
        ignore_global_filters:
          type: boolean
          description: 'When `true`, ignores global filters when fetching data for this layer. Defaults to `false`.'
          default: false
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleLegend'
        metrics:
          maxItems: 100
          minItems: 1
          type: array
          items:
            allOf:
              - anyOf:
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visUniqueCountMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMinMaxAvgMedianStdDevMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visSumMetricOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visLastValueOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visPercentileRanksOperation'
                  - anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visDifferencesOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visMovingAverageOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCumulativeSumOperation'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visCounterRateOperation'
                  - $ref: '#/components/schemas/Kibana_HTTP_APIs_visFormulaOperation'
              - type: object
                properties:
                  color:
                    anyOf:
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visStaticColor'
                      - $ref: '#/components/schemas/Kibana_HTTP_APIs_visAutoColor'
                    default:
                      type: auto
          description: Array of metric configurations (minimum 1)
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        sampling:
          maximum: 1
          minimum: 0
          type: number
          description: Sampling factor between 0 (no sampling) and 1 (full sampling).
          default: 1
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visWaffleStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - waffle
          type: string
      additionalProperties: false
    Kibana_HTTP_APIs_WiredStreamUpsertRequest:
      required:
        - dashboards
        - rules
        - stream
      type: object
      properties:
        dashboards:
          type: array
          items:
            type: string
        rules:
          type: array
          items:
            type: string
        stream:
          required:
            - description
            - ingest
            - type
          type: object
          properties:
            description:
              type: string
            ingest:
              required:
                - lifecycle
                - processing
                - settings
                - failure_store
                - wired
              type: object
              properties:
                failure_store:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_FailureStore'
                lifecycle:
                  $ref: '#/components/schemas/Kibana_HTTP_APIs_IngestStreamLifecycle'
                processing:
                  required:
                    - steps
                  type: object
                  properties:
                    steps:
                      type: array
                      items:
                        $ref: '#/components/schemas/Kibana_HTTP_APIs_StreamlangStep'
                  additionalProperties: false
                settings:
                  type: object
                  properties:
                    index.number_of_replicas:
                      required:
                        - value
                      type: object
                      properties:
                        value:
                          type: number
                      additionalProperties: false
                    index.number_of_shards:
                      required:
                        - value
                      type: object
                      properties:
                        value:
                          type: number
                      additionalProperties: false
                    index.refresh_interval:
                      required:
                        - value
                      type: object
                      properties:
                        value:
                          anyOf:
                            - type: string
                            - enum:
                                - -1
                              type: number
                      additionalProperties: false
                  additionalProperties: false
                wired:
                  required:
                    - fields
                    - routing
                  type: object
                  properties:
                    draft:
                      type: boolean
                    fields:
                      $ref: '#/components/schemas/Kibana_HTTP_APIs_FieldDefinition'
                    routing:
                      type: array
                      items:
                        required:
                          - destination
                          - where
                        type: object
                        properties:
                          destination:
                            minLength: 1
                            type: string
                            description: A non-empty string.
                          draft:
                            type: boolean
                          status:
                            enum:
                              - enabled
                              - disabled
                            type: string
                          where:
                            $ref: '#/components/schemas/Kibana_HTTP_APIs_Condition'
                  additionalProperties: false
              additionalProperties: false
            query_streams:
              type: array
              items:
                required:
                  - name
                type: object
                properties:
                  name:
                    type: string
            type:
              enum:
                - wired
              type: string
          additionalProperties: false
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-ml-anomaly-detection-alert-create-rule-body-alerting:
      title: Anomaly detection
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Anomaly Detection Rule Params
          required:
            - jobSelection
            - severity
            - resultType
          type: object
          properties:
            includeInterim:
              type: boolean
              default: true
            jobSelection:
              type: object
              properties:
                groupIds:
                  type: array
                  items:
                    type: string
                  default: [ ]
                jobIds:
                  type: array
                  items:
                    type: string
                  default: [ ]
              additionalProperties: false
            kqlQueryString:
              type:
                - 'null'
                - string
              default: 'null'
            lookbackInterval:
              type:
                - 'null'
                - string
              default: 'null'
            resultType:
              enum:
                - record
                - bucket
                - influencer
              type: string
            severity:
              maximum: 100
              minimum: 0
              type: number
            topNBuckets:
              minimum: 1
              type:
                - 'null'
                - number
              default: 'null'
          additionalProperties: false
          description: The parameters for the anomaly detection rule. These parameters are appropriate when `rule_type_id` is `xpack.ml.anomaly_detection_alert"`.
        rule_type_id:
          enum:
            - xpack.ml.anomaly_detection_alert
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-ml-anomaly-detection-jobs-health-create-rule-body-alerting:
      title: Anomaly detection jobs health
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Anomaly Detection Jobs Health Rule Params
          required:
            - includeJobs
          type: object
          properties:
            excludeJobs:
              type:
                - 'null'
                - object
              properties:
                groupIds:
                  type: array
                  items:
                    type: string
                  default: [ ]
                jobIds:
                  type: array
                  items:
                    type: string
                  default: [ ]
              additionalProperties: false
              default: 'null'
            includeJobs:
              type: object
              properties:
                groupIds:
                  type: array
                  items:
                    type: string
                  default: [ ]
                jobIds:
                  type: array
                  items:
                    type: string
                  default: [ ]
              additionalProperties: false
            testsConfig:
              type:
                - 'null'
                - object
              properties:
                behindRealtime:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: true
                    timeInterval:
                      type:
                        - 'null'
                        - string
                      default: 'null'
                  additionalProperties: false
                  default: 'null'
                datafeed:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: true
                  additionalProperties: false
                  default: 'null'
                delayedData:
                  type:
                    - 'null'
                    - object
                  properties:
                    docsCount:
                      minimum: 1
                      type:
                        - 'null'
                        - number
                      default: 'null'
                    docsCountPercentage:
                      maximum: 100
                      minimum: 0
                      type:
                        - 'null'
                        - number
                      default: 'null'
                    enabled:
                      type: boolean
                      default: true
                    thresholdType:
                      enum:
                        - count
                        - percentage
                      type: string
                    timeInterval:
                      type:
                        - 'null'
                        - string
                      default: 'null'
                  additionalProperties: false
                  default: 'null'
                errorMessages:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: true
                  additionalProperties: false
                  default: 'null'
                mml:
                  type:
                    - 'null'
                    - object
                  properties:
                    enabled:
                      type: boolean
                      default: true
                  additionalProperties: false
                  default: 'null'
              additionalProperties: false
              default: 'null'
          additionalProperties: false
          description: The parameters for the anomaly detection jobs health rule. These parameters are appropriate when `rule_type_id` is `xpack.ml.anomaly_detection_jobs_health"`.
        rule_type_id:
          enum:
            - xpack.ml.anomaly_detection_jobs_health
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-synthetics-alerts-monitorstatus-create-rule-body-alerting:
      title: Synthetics monitor status
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Synthetics Monitor Status Rule Params
          type: object
          properties:
            condition:
              required:
                - window
              type: object
              properties:
                alertOnNoData:
                  type: boolean
                downThreshold:
                  type: number
                groupBy:
                  type: string
                includeRetests:
                  type: boolean
                locationsThreshold:
                  type: number
                pendingThreshold:
                  maximum: 100
                  minimum: 1
                  type: number
                recoveryStrategy:
                  enum:
                    - firstUp
                    - conditionNotMet
                  type: string
                window:
                  anyOf:
                    - required:
                        - time
                      type: object
                      properties:
                        time:
                          type: object
                          properties:
                            size:
                              type: number
                              default: 5
                            unit:
                              enum:
                                - s
                                - m
                                - h
                                - d
                              type: string
                              default: m
                          additionalProperties: false
                      additionalProperties: false
                    - type: object
                      properties:
                        numberOfChecks:
                          maximum: 100
                          minimum: 1
                          type: number
                          default: 5
                      additionalProperties: false
              additionalProperties: false
            kqlQuery:
              type: string
            locations:
              type: array
              items:
                type: string
            monitorIds:
              type: array
              items:
                type: string
            monitorTypes:
              type: array
              items:
                type: string
            projects:
              type: array
              items:
                type: string
            tags:
              type: array
              items:
                type: string
          additionalProperties: false
          description: The parameters for the synthetics monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.synthetics.alerts.monitorStatus`.
        rule_type_id:
          enum:
            - xpack.synthetics.alerts.monitorStatus
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-synthetics-alerts-tls-create-rule-body-alerting:
      title: Synthetics TLS
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Synthetics TLS Rule Params
          type: object
          properties:
            browserResourceTypes:
              maxItems: 100
              type: array
              items:
                maxLength: 1024
                type: string
            certAgeThreshold:
              type: number
            certExpirationThreshold:
              type: number
            certOrigin:
              maxItems: 100
              type: array
              items:
                maxLength: 256
                type: string
            includeBrowserCerts:
              type: boolean
            issuers:
              maxItems: 1000
              type: array
              items:
                maxLength: 4096
                type: string
            kqlQuery:
              type: string
            locations:
              type: array
              items:
                type: string
            monitorIds:
              type: array
              items:
                type: string
            monitorTypes:
              type: array
              items:
                type: string
            projects:
              type: array
              items:
                type: string
            search:
              type: string
            tags:
              type: array
              items:
                type: string
          additionalProperties: false
          description: The parameters for the synthetics tls rule. These parameters are appropriate when `rule_type_id` is `xpack.synthetics.alerts.tls`.
        rule_type_id:
          enum:
            - xpack.synthetics.alerts.tls
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-uptime-alerts-durationanomaly-create-rule-body-alerting:
      title: Uptime duration anomaly
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Uptime Duration Anomaly Rule Params
          required:
            - monitorId
            - severity
          type: object
          properties:
            monitorId:
              type: string
            severity:
              type: number
            stackVersion:
              type: string
          additionalProperties: false
          description: The parameters for the uptime duration anomaly rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.durationAnomaly`.
        rule_type_id:
          enum:
            - xpack.uptime.alerts.durationAnomaly
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-uptime-alerts-monitorstatus-create-rule-body-alerting:
      title: Uptime monitor status
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Uptime Monitor Status Rule Params
          required:
            - numTimes
            - shouldCheckStatus
            - shouldCheckAvailability
          type: object
          properties:
            availability:
              required:
                - range
                - rangeUnit
                - threshold
              type: object
              properties:
                range:
                  type: number
                rangeUnit:
                  type: string
                threshold:
                  type: string
              additionalProperties: false
            filters:
              anyOf:
                - type: object
                  properties:
                    monitor.type:
                      type: array
                      items:
                        type: string
                    observer.geo.name:
                      type: array
                      items:
                        type: string
                    tags:
                      type: array
                      items:
                        type: string
                    url.port:
                      type: array
                      items:
                        type: string
                  additionalProperties: false
                - type: string
            isAutoGenerated:
              type: boolean
            locations:
              type: array
              items:
                type: string
            numTimes:
              type: number
            search:
              type: string
            shouldCheckAvailability:
              type: boolean
            shouldCheckStatus:
              type: boolean
            stackVersion:
              type: string
            timerange:
              required:
                - from
                - to
              type: object
              properties:
                from:
                  type: string
                to:
                  type: string
              additionalProperties: false
            timerangeCount:
              type: number
            timerangeUnit:
              type: string
            version:
              type: number
          additionalProperties: false
          description: The parameters for the uptime monitor status rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.monitorStatus`.
        rule_type_id:
          enum:
            - xpack.uptime.alerts.monitorStatus
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xpack-uptime-alerts-tlscertificate-create-rule-body-alerting:
      title: Uptime TLS certificate
      required:
        - name
        - consumer
        - schedule
        - rule_type_id
        - params
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_new_rule_action'
          default: [ ]
        alert_delay:
          required:
            - active
          type: object
          properties:
            active:
              type: number
              description: The number of consecutive runs that must meet the rule conditions.
          additionalProperties: false
          description: Indicates that an alert occurs only when the specified number of consecutive runs met the rule conditions.
        artifacts:
          type: object
          properties:
            dashboards:
              maxItems: 10
              type: array
              items:
                required:
                  - id
                type: object
                properties:
                  id:
                    type: string
                additionalProperties: false
            investigation_guide:
              required:
                - blob
              type: object
              properties:
                blob:
                  maxLength: 10000
                  type: string
              additionalProperties: false
          additionalProperties: false
        consumer:
          type: string
          description: 'The name of the application or feature that owns the rule. For example: `alerts`, `apm`, `discover`, `infrastructure`, `logs`, `metrics`, `ml`, `monitoring`, `securitySolution`, `siem`, `stackAlerts`, or `uptime`.'
        enabled:
          type: boolean
          description: Indicates whether you want the rule to run on an interval basis after it is created.
          default: true
        flapping:
          allOf:
            - $ref: '#/components/schemas/Kibana_HTTP_APIs_rule_flapping'
        name:
          type: string
          description: 'The name of the rule. While this name does not have to be unique, a distinctive name can help you identify a rule.'
        notify_when:
          enum:
            - onActionGroupChange
            - onActiveAlert
            - onThrottleInterval
            - 'null'
          type:
            - 'null'
            - string
          description: 'Indicates how frequently rule actions are triggered. Valid values include: `onActionGroupChange`: Actions run when the alert status changes; `onActiveAlert`: Actions run when the alert becomes active and at each check interval while the rule conditions are met; `onThrottleInterval`: Actions run when the alert becomes active and at the interval specified in the throttle property while the rule conditions are met. You cannot specify `notify_when` at both the rule and action level. The recommended approach is to set it for each action individually. If you set `notify_when` at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
        params:
          title: Uptime TLS Rule Params
          type: object
          properties:
            certAgeThreshold:
              type: number
            certExpirationThreshold:
              type: number
            search:
              type: string
            stackVersion:
              type: string
          additionalProperties: false
          description: The parameters for the uptime tls rule. These parameters are appropriate when `rule_type_id` is `xpack.uptime.alerts.tlsCertificate`.
        rule_type_id:
          enum:
            - xpack.uptime.alerts.tlsCertificate
          type: string
        schedule:
          required:
            - interval
          type: object
          properties:
            interval:
              type: string
              description: 'The interval is specified in seconds, minutes, hours, or days.'
          additionalProperties: false
          description: 'The check interval, which specifies how frequently the rule conditions are checked.'
        tags:
          type: array
          items:
            type: string
          description: The tags for the rule.
          default: [ ]
        template_id:
          maxLength: 1024
          type: string
          description: 'The identifier for the rule template this rule was created from, when known.'
        throttle:
          type:
            - 'null'
            - string
          description: 'Use the `throttle` property in the action `frequency` object instead. The throttle interval, which defines how frequently rule actions are triggered. You cannot specify the throttle interval at both the rule and action level. If you set the throttle interval at the rule level and then edit the rule, it will automatically be converted to action-specific values.'
      additionalProperties: false
    Kibana_HTTP_APIs_xyLibItemNoESQL:
      title: XY Chart (library)
      required:
        - type
        - layers
      type: object
      properties:
        axis:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visApiXyAxisConfig'
        description:
          type: string
          description: The description of the chart. Optional. Any string value or undefined.
        filters:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visPanelFilters'
        layers:
          maxItems: 100
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLayersNoESQL'
          description: Chart layers
        legend:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyLegend'
        query:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visFilterSimple'
        styling:
          $ref: '#/components/schemas/Kibana_HTTP_APIs_visXyStyling'
        tags:
          maxItems: 1000
          type: array
          items:
            maxLength: 250
            type: string
          description: Tag IDs to associate with this visualization.
          default: [ ]
        title:
          type: string
          description: The title of the chart displayed in the panel. Optional. Any string value or undefined.
        type:
          enum:
            - xy
          type: string
      additionalProperties: false
    Machine_learning_APIs_mlSync200Response:
      title: Successful sync API response
      type: object
      properties:
        datafeedsAdded:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds'
          description: 'If a saved object for an anomaly detection job is missing a datafeed identifier, it is added when you run the sync machine learning saved objects API.'
        datafeedsRemoved:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDatafeeds'
          description: 'If a saved object for an anomaly detection job references a datafeed that no longer exists, it is deleted when you run the sync machine learning saved objects API.'
        savedObjectsCreated:
          $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsCreated'
        savedObjectsDeleted:
          $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted'
    Machine_learning_APIs_mlSync4xxResponse:
      title: Unsuccessful sync API response
      type: object
      properties:
        error:
          type: string
          example: Unauthorized
        message:
          type: string
        statusCode:
          type: integer
          example: 401
    Machine_learning_APIs_mlSyncResponseAnomalyDetectors:
      title: Sync API response for anomaly detection jobs
      type: object
      properties:
        success:
          $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
      description: 'The sync machine learning saved objects API response contains this object when there are anomaly detection jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.'
    Machine_learning_APIs_mlSyncResponseDatafeeds:
      title: Sync API response for datafeeds
      type: object
      properties:
        success:
          $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
      description: 'The sync machine learning saved objects API response contains this object when there are datafeeds affected by the synchronization. There is an object for each relevant datafeed, which contains the synchronization status.'
    Machine_learning_APIs_mlSyncResponseDataFrameAnalytics:
      title: Sync API response for data frame analytics jobs
      type: object
      properties:
        success:
          $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
      description: 'The sync machine learning saved objects API response contains this object when there are data frame analytics jobs affected by the synchronization. There is an object for each relevant job, which contains the synchronization status.'
    Machine_learning_APIs_mlSyncResponseSavedObjectsCreated:
      title: Sync API response for created saved objects
      type: object
      properties:
        anomaly-detector:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors'
          description: 'If saved objects are missing for anomaly detection jobs, they are created.'
        data-frame-analytics:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics'
          description: 'If saved objects are missing for data frame analytics jobs, they are created.'
        trained-model:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels'
          description: 'If saved objects are missing for trained models, they are created.'
      description: 'If saved objects are missing for machine learning jobs or trained models, they are created when you run the sync machine learning saved objects API.'
    Machine_learning_APIs_mlSyncResponseSavedObjectsDeleted:
      title: Sync API response for deleted saved objects
      type: object
      properties:
        anomaly-detector:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseAnomalyDetectors'
          description: 'If there are saved objects exist for nonexistent anomaly detection jobs, they are deleted.'
        data-frame-analytics:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseDataFrameAnalytics'
          description: 'If there are saved objects exist for nonexistent data frame analytics jobs, they are deleted.'
        trained-model:
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseTrainedModels'
          description: 'If there are saved objects exist for nonexistent trained models, they are deleted.'
      description: 'If saved objects exist for machine learning jobs or trained models that no longer exist, they are deleted when you run the sync machine learning saved objects API.'
    Machine_learning_APIs_mlSyncResponseSuccess:
      type: boolean
      description: The success or failure of the synchronization.
    Machine_learning_APIs_mlSyncResponseTrainedModels:
      title: Sync API response for trained models
      type: object
      properties:
        success:
          $ref: '#/components/schemas/Machine_learning_APIs_mlSyncResponseSuccess'
      description: 'The sync machine learning saved objects API response contains this object when there are trained models affected by the synchronization. There is an object for each relevant trained model, which contains the synchronization status.'
    Observability_AI_Assistant_API_Function:
      type: object
      properties:
        description:
          type: string
          description: The description of the function.
        name:
          type: string
          description: The name of the function.
        parameters:
          type: object
          description: The parameters of the function.
    Observability_AI_Assistant_API_FunctionCall:
      required:
        - name
        - trigger
      type: object
      properties:
        arguments:
          type: string
          description: The arguments for the function call.
        name:
          type: string
          description: The name of the function.
        trigger:
          enum:
            - assistant
            - user
            - elastic
          type: string
          description: The trigger of the function call.
      description: Details of the function call within the message.
    Observability_AI_Assistant_API_Instruction:
      oneOf:
        - type: string
          description: A simple instruction represented as a string.
        - required:
            - id
            - text
          type: object
          properties:
            id:
              type: string
              description: A unique identifier for the instruction.
            text:
              type: string
              description: The text of the instruction.
          description: A detailed instruction with an ID and text.
    Observability_AI_Assistant_API_Message:
      title: Message
      required:
        - '@timestamp'
        - message
      type: object
      properties:
        '@timestamp':
          type: string
          description: The timestamp when the message was created.
        message:
          required:
            - role
          type: object
          properties:
            content:
              type: string
              description: The content of the message.
            data:
              type: string
              description: Additional data associated with the message.
            event:
              type: string
              description: The event related to the message.
            function_call:
              $ref: '#/components/schemas/Observability_AI_Assistant_API_FunctionCall'
            name:
              type: string
              description: The name associated with the message.
            role:
              $ref: '#/components/schemas/Observability_AI_Assistant_API_MessageRoleEnum'
          description: The main content of the message.
    Observability_AI_Assistant_API_MessageRoleEnum:
      enum:
        - system
        - assistant
        - function
        - user
        - elastic
      type: string
      description: The role of the message sender.
    Saved_objects_400_response:
      title: Bad request
      required:
        - error
        - message
        - statusCode
      type: object
      properties:
        error:
          enum:
            - Bad Request
          type: string
        message:
          type: string
        statusCode:
          enum:
            - 400
          type: integer
    Security_AI_Assistant_API_AnonymizationFieldCreateProps:
      required:
        - field
      type: object
      properties:
        allowed:
          type: boolean
          description: Whether this field is allowed to be sent to the model.
          example: true
        anonymized:
          type: boolean
          description: Whether this field should be anonymized.
          example: false
        field:
          type: string
          description: Name of the anonymization field to create.
          example: host.name
    Security_AI_Assistant_API_AnonymizationFieldDetailsInError:
      required:
        - id
      type: object
      properties:
        id:
          type: string
          description: The ID of the anonymization field.
          example: field12
        name:
          type: string
          description: Name of the anonymization field.
          example: host.name
    Security_AI_Assistant_API_AnonymizationFieldResponse:
      required:
        - id
        - field
      type: object
      properties:
        allowed:
          type: boolean
          description: Whether this field is allowed to be sent to the model.
          example: true
        anonymized:
          type: boolean
          description: Whether this field should be anonymized.
          example: false
        createdAt:
          type: string
          description: Timestamp of when the anonymization field was created.
          example: '2023-10-31T12:00:00Z'
        createdBy:
          type: string
          description: Username of the person who created the anonymization field.
          example: user1
        field:
          type: string
          description: Name of the anonymization field.
          example: url.domain
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        namespace:
          type: string
          description: Kibana space in which this anonymization field exists.
          example: default
        timestamp:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
        updatedAt:
          type: string
          description: Timestamp of the last update.
          example: '2023-10-31T12:00:00Z'
        updatedBy:
          type: string
          description: Username of the person who last updated the field.
          example: user1
    Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason:
      enum:
        - ANONYMIZATION_FIELD_NOT_MODIFIED
      type: string
      description: Reason why the anonymization field was not modified.
    Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult:
      required:
        - id
        - skip_reason
      type: object
      properties:
        id:
          type: string
          description: The ID of the anonymization field that was not modified.
          example: field4
        name:
          type: string
          description: Name of the anonymization field that was not modified.
          example: user.name
        skip_reason:
          $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipReason'
    Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResponse:
      required:
        - attributes
      type: object
      properties:
        anonymization_fields_count:
          type: integer
          description: Total number of anonymization fields processed.
          example: 5
        attributes:
          required:
            - results
            - summary
          type: object
          properties:
            errors:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedAnonymizationFieldError'
              description: List of errors that occurred during the bulk operation.
            results:
              $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults'
            summary:
              $ref: '#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary'
        message:
          type: string
          description: Message providing information about the bulk action result.
          example: Bulk action completed successfully
        status_code:
          type: integer
          description: HTTP status code returned.
          example: 200
        success:
          type: boolean
          description: Indicates if the bulk action was successful.
          example: true
    Security_AI_Assistant_API_AnonymizationFieldsBulkCrudActionResults:
      required:
        - updated
        - created
        - deleted
        - skipped
      type: object
      properties:
        created:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
          description: List of anonymization fields successfully created.
        deleted:
          type: array
          items:
            type: string
            description: Array of IDs of anonymization fields that were deleted.
            example: field3
        skipped:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldsBulkActionSkipResult'
          description: List of anonymization fields that were skipped during the operation.
        updated:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldResponse'
          description: List of anonymization fields successfully updated.
    Security_AI_Assistant_API_AnonymizationFieldUpdateProps:
      required:
        - id
      type: object
      properties:
        allowed:
          type: boolean
          description: Whether this field is allowed to be sent to the model.
          example: true
        anonymized:
          type: boolean
          description: Whether this field should be anonymized.
          example: false
        id:
          type: string
          description: The ID of the anonymization field to update.
          example: field8
    Security_AI_Assistant_API_ApiConfig:
      required:
        - connectorId
        - actionTypeId
      type: object
      properties:
        actionTypeId:
          type: string
          description: Action type ID
          example: actionType456
        connectorId:
          type: string
          description: Connector ID
          example: connector123
        defaultSystemPromptId:
          type: string
          description: Default system prompt ID
          example: systemPrompt001
        model:
          type: string
          description: Model
          example: gpt-4
        provider:
          $ref: '#/components/schemas/Security_AI_Assistant_API_Provider'
    Security_AI_Assistant_API_BaseContentReference:
      required:
        - id
        - type
      type: object
      properties:
        id:
          type: string
          description: Id of the content reference
          example: content123
        type:
          type: string
          description: Type of the content reference
          example: SecurityAlert
      description: The basis of a content reference
    Security_AI_Assistant_API_BaseInterruptResumeValue:
      required:
        - type
      type: object
      properties:
        type:
          $ref: '#/components/schemas/Security_AI_Assistant_API_InterruptType'
      description: The basis of an interrupt resume value
    Security_AI_Assistant_API_BaseInterruptValue:
      required:
        - type
        - threadId
      type: object
      properties:
        expired:
          type: boolean
          description: Whether the interrupt has expired and can no longer be resumed.
          example: false
        threadId:
          type: string
          description: Thread ID of the graph execution that produced this message.
          example: <UUID>
        type:
          $ref: '#/components/schemas/Security_AI_Assistant_API_InterruptType'
      description: The basis of an agent interrupt
    Security_AI_Assistant_API_BulkCrudActionSummary:
      required:
        - failed
        - skipped
        - succeeded
        - total
      type: object
      properties:
        failed:
          type: integer
          description: The number of failed actions.
          example: 0
        skipped:
          type: integer
          description: The number of skipped actions.
          example: 1
        succeeded:
          type: integer
          description: The number of successfully performed actions.
          example: 10
        total:
          type: integer
          description: The total number of actions attempted.
          example: 12
    Security_AI_Assistant_API_ChatCompleteProps:
      required:
        - messages
        - persist
        - connectorId
      type: object
      properties:
        connectorId:
          type: string
          description: Required connector identifier to route the request.
          example: conn-001
        conversationId:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        isStream:
          type: boolean
          description: 'If true, the response will be streamed in chunks.'
          example: true
        langSmithApiKey:
          type: string
          description: API key for LangSmith integration.
          example: <LANGSMITH_API_KEY>
        langSmithProject:
          type: string
          description: LangSmith project name for tracing.
          example: security_ai_project
        messages:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_ChatMessage'
          description: List of chat messages exchanged so far.
        model:
          type: string
          description: Model ID or name to use for the response.
          example: gpt-4
        persist:
          type: boolean
          description: Whether to persist the chat and response to storage.
          example: true
        promptId:
          type: string
          description: Prompt template identifier.
          example: prompt_001
        responseLanguage:
          type: string
          description: ISO language code for the assistant's response.
          example: en
      description: The request payload for creating a chat completion.
      example:
        connectorId: conn-001
        conversationId: abc123
        isStream: true
        langSmithApiKey: <LANGSMITH_API_KEY>
        langSmithProject: security_ai_project
        messages:
          - content: How do I detect ransomware on my endpoints?
            data:
              device_id: device-567
            fields_to_anonymize:
              - device.name
              - file.path
            role: user
        model: gpt-4
        persist: true
        promptId: prompt_456
        responseLanguage: en
    Security_AI_Assistant_API_ChatMessage:
      required:
        - role
      type: object
      properties:
        content:
          type: string
          description: The textual content of the message.
          example: What security incidents have been reported today?
        data:
          $ref: '#/components/schemas/Security_AI_Assistant_API_MessageData'
        fields_to_anonymize:
          type: array
          items:
            type: string
          description: List of field names within the data object that should be anonymized.
          example:
            - user.name
            - source.ip
        role:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ChatMessageRole'
      description: A message exchanged within the AI chat conversation.
    Security_AI_Assistant_API_ChatMessageRole:
      enum:
        - system
        - user
        - assistant
      type: string
      description: The role associated with the message in the chat.
      example: user
    Security_AI_Assistant_API_ContentReferences:
      type: object
      additionalProperties:
        oneOf:
          - $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryContentReference'
          - $ref: '#/components/schemas/Security_AI_Assistant_API_SecurityAlertContentReference'
          - $ref: '#/components/schemas/Security_AI_Assistant_API_SecurityAlertsPageContentReference'
          - $ref: '#/components/schemas/Security_AI_Assistant_API_ProductDocumentationContentReference'
          - $ref: '#/components/schemas/Security_AI_Assistant_API_EsqlContentReference'
          - $ref: '#/components/schemas/Security_AI_Assistant_API_HrefContentReference'
      description: A union of all content reference types
    Security_AI_Assistant_API_ConversationCategory:
      enum:
        - assistant
        - insights
      type: string
      description: The conversation category.
      example: assistant
    Security_AI_Assistant_API_ConversationCreateProps:
      required:
        - title
      type: object
      properties:
        apiConfig:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
        category:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
        excludeFromLastConversationStorage:
          type: boolean
          description: Exclude from last conversation storage.
        id:
          type: string
          description: The conversation id.
          example: conversation123
        messages:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_Message'
          description: The conversation messages.
        replacements:
          $ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
        title:
          type: string
          description: The conversation title.
          example: Security AI Assistant Setup
    Security_AI_Assistant_API_ConversationResponse:
      required:
        - id
        - title
        - createdAt
        - createdBy
        - users
        - namespace
        - category
      type: object
      properties:
        apiConfig:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
        category:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
        createdAt:
          type: string
          description: The time conversation was created.
          example: '2025-04-30T14:00:00Z'
        createdBy:
          $ref: '#/components/schemas/Security_AI_Assistant_API_User'
        excludeFromLastConversationStorage:
          type: boolean
          description: Exclude from last conversation storage.
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        messages:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_Message'
          description: The conversation messages.
        namespace:
          type: string
          description: Kibana space
          example: default
        replacements:
          $ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
        timestamp:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
        title:
          type: string
          description: The conversation title.
          example: Security AI Assistant Setup
        updatedAt:
          type: string
          description: The last time conversation was updated.
          example: '2025-04-30T16:30:00Z'
        users:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_User'
    Security_AI_Assistant_API_ConversationUpdateProps:
      required:
        - id
      type: object
      properties:
        apiConfig:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ApiConfig'
        category:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ConversationCategory'
        excludeFromLastConversationStorage:
          type: boolean
          description: Exclude from last conversation storage.
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        messages:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_Message'
          description: The conversation messages.
        replacements:
          $ref: '#/components/schemas/Security_AI_Assistant_API_Replacements'
        title:
          type: string
          description: The conversation title.
          example: Updated Security AI Assistant Setup
        users:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_User'
    Security_AI_Assistant_API_DeleteResponseFields:
      required:
        - id
      type: object
      properties:
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
    Security_AI_Assistant_API_DocumentEntry:
      allOf:
        - required:
            - name
            - namespace
            - global
            - users
          type: object
          properties:
            global:
              type: boolean
              description: 'Whether this Knowledge Base Entry is global, defaults to false.'
              example: false
            name:
              type: string
              description: Name of the Knowledge Base Entry.
              example: Example Entry
            namespace:
              type: string
              description: 'Kibana Space, defaults to ''default'' space.'
              example: default
            users:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
              description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryResponseFields'
    Security_AI_Assistant_API_DocumentEntryCreateFields:
      allOf:
        - required:
            - name
          type: object
          properties:
            global:
              type: boolean
              description: 'Whether this Knowledge Base Entry is global, defaults to false.'
              example: false
            name:
              type: string
              description: Name of the Knowledge Base Entry.
              example: Example Entry
            namespace:
              type: string
              description: 'Kibana Space, defaults to ''default'' space.'
              example: default
            users:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
              description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
    Security_AI_Assistant_API_DocumentEntryOptionalFields:
      type: object
      properties:
        required:
          type: boolean
          description: 'Whether this resource should always be included, defaults to false.'
          example: false
        vector:
          $ref: '#/components/schemas/Security_AI_Assistant_API_Vector'
    Security_AI_Assistant_API_DocumentEntryRequiredFields:
      required:
        - type
        - kbResource
        - source
        - text
      type: object
      properties:
        kbResource:
          $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseResource'
        source:
          type: string
          description: Source document name or filepath.
          example: /documents/example.txt
        text:
          type: string
          description: Knowledge Base Entry content.
          example: This is the content of the document.
        type:
          enum:
            - document
          type: string
          description: Entry type.
          example: document
    Security_AI_Assistant_API_DocumentEntryResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryRequiredFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryOptionalFields'
    Security_AI_Assistant_API_DocumentEntryUpdateFields:
      allOf:
        - required:
            - id
          type: object
          properties:
            global:
              type: boolean
              description: 'Whether this Knowledge Base Entry is global, defaults to false.'
              example: false
            id:
              $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
            name:
              type: string
              description: Name of the Knowledge Base Entry.
              example: Example Entry
            namespace:
              type: string
              description: 'Kibana Space, defaults to ''default'' space.'
              example: default
            users:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
              description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
    Security_AI_Assistant_API_EsqlContentReference:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
        - required:
            - type
            - query
            - label
          type: object
          properties:
            label:
              type: string
              description: Label of the query
              example: High Severity Alerts
            query:
              type: string
              description: An ESQL query
              example: SELECT * FROM alerts WHERE severity = "high"
            timerange:
              required:
                - from
                - to
              type: object
              properties:
                from:
                  type: string
                  example: '2025-04-01T00:00:00Z'
                to:
                  type: string
                  example: '2025-04-30T23:59:59Z'
              description: Time range to select in the time picker.
            type:
              enum:
                - EsqlQuery
              type: string
              example: EsqlQuery
      description: References an ESQL query
    Security_AI_Assistant_API_FindAnonymizationFieldsSortField:
      enum:
        - created_at
        - anonymized
        - allowed
        - field
        - updated_at
      type: string
    Security_AI_Assistant_API_FindConversationsSortField:
      enum:
        - created_at
        - title
        - updated_at
      type: string
      description: 'The field by which to sort the conversations. Possible values are `created_at`, `title`, and `updated_at`.'
      example: created_at
    Security_AI_Assistant_API_FindKnowledgeBaseEntriesSortField:
      enum:
        - created_at
        - is_default
        - title
        - updated_at
      type: string
      description: Fields available for sorting Knowledge Base Entries.
      example: title
    Security_AI_Assistant_API_FindPromptsSortField:
      enum:
        - created_at
        - is_default
        - name
        - updated_at
      type: string
      description: Field by which to sort the prompts.
      example: created_at
    Security_AI_Assistant_API_HrefContentReference:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
        - required:
            - type
            - href
          type: object
          properties:
            href:
              type: string
              description: URL to the external resource
            label:
              type: string
              description: Label of the query
            type:
              enum:
                - Href
              type: string
      description: References an external URL
    Security_AI_Assistant_API_IndexEntry:
      allOf:
        - required:
            - name
            - namespace
            - global
            - users
          type: object
          properties:
            global:
              type: boolean
              description: 'Whether this Knowledge Base Entry is global, defaults to false.'
              example: false
            name:
              type: string
              description: Name of the Knowledge Base Entry.
              example: Example Entry
            namespace:
              type: string
              description: 'Kibana Space, defaults to ''default'' space.'
              example: default
            users:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
              description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_ResponseFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryResponseFields'
    Security_AI_Assistant_API_IndexEntryCreateFields:
      allOf:
        - required:
            - name
          type: object
          properties:
            global:
              type: boolean
              description: 'Whether this Knowledge Base Entry is global, defaults to false.'
              example: false
            name:
              type: string
              description: Name of the Knowledge Base Entry.
              example: Example Entry
            namespace:
              type: string
              description: 'Kibana Space, defaults to ''default'' space.'
              example: default
            users:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
              description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
    Security_AI_Assistant_API_IndexEntryOptionalFields:
      type: object
      properties:
        inputSchema:
          $ref: '#/components/schemas/Security_AI_Assistant_API_InputSchema'
        outputFields:
          type: array
          items:
            type: string
          description: 'Fields to extract from the query result, defaults to all fields if not provided or empty.'
          example:
            - title
            - author
    Security_AI_Assistant_API_IndexEntryRequiredFields:
      required:
        - type
        - index
        - field
        - description
        - queryDescription
      type: object
      properties:
        description:
          type: string
          description: Description for when this index or data stream should be queried for Knowledge Base content. Passed to the LLM as a tool description.
          example: Query this index for general knowledge base content.
        field:
          type: string
          description: Field to query for Knowledge Base content.
          example: content
        index:
          type: string
          description: Index or Data Stream to query for Knowledge Base content.
          example: knowledge_base_index
        queryDescription:
          type: string
          description: Description of query field used to fetch Knowledge Base content. Passed to the LLM as part of the tool input schema.
          example: Search for documents containing the specified keywords.
        type:
          enum:
            - index
          type: string
          description: Entry type.
          example: index
    Security_AI_Assistant_API_IndexEntryResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryRequiredFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryOptionalFields'
    Security_AI_Assistant_API_IndexEntryUpdateFields:
      allOf:
        - required:
            - id
          type: object
          properties:
            global:
              type: boolean
              description: 'Whether this Knowledge Base Entry is global, defaults to false.'
              example: false
            id:
              $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
            name:
              type: string
              description: Name of the Knowledge Base Entry.
              example: Example Entry
            namespace:
              type: string
              description: 'Kibana Space, defaults to ''default'' space.'
              example: default
            users:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_User'
              description: 'Users who have access to the Knowledge Base Entry, defaults to current user. Empty array provides access to all users.'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
    Security_AI_Assistant_API_InputSchema:
      type: array
      items:
        required:
          - fieldName
          - fieldType
          - description
        type: object
        properties:
          description:
            type: string
            description: Description of the field.
            example: The title of the document.
          fieldName:
            type: string
            description: Name of the field.
            example: title
          fieldType:
            type: string
            description: Type of the field.
            example: string
      description: 'Array of objects defining the input schema, allowing the LLM to extract structured data to be used in retrieval.'
    Security_AI_Assistant_API_InputTextInterruptResumeValue:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptResumeValue'
        - required:
            - value
            - type
          type: object
          properties:
            type:
              enum:
                - INPUT_TEXT
              type: string
              example: INPUT_TEXT
            value:
              type: string
              description: Text value used to resume the graph execution with.
              example: .logs*
      description: A resume value for input text
    Security_AI_Assistant_API_InputTextInterruptValue:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptValue'
        - required:
            - type
          type: object
          properties:
            description:
              type: string
              description: Description of action required
              example: What is the index you would like to use for the query.
            placeholder:
              type: string
              description: Placeholder text for the input field
              example: Enter index pattern here...
            type:
              enum:
                - INPUT_TEXT
              type: string
              example: INPUT_TEXT
      description: Interrupt that requests user to provide text input
    Security_AI_Assistant_API_InterruptResumeValue:
      oneOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptResumeValue'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_InputTextInterruptResumeValue'
      description: Union of the interrupt resume values
    Security_AI_Assistant_API_InterruptType:
      enum:
        - SELECT_OPTION
        - INPUT_TEXT
      type: string
      description: The type of interrupt
    Security_AI_Assistant_API_InterruptValue:
      oneOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptValue'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_InputTextInterruptValue'
      description: Union of the interrupt values
    Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason:
      enum:
        - KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
      type: string
      description: Reason why a Knowledge Base Entry was skipped during the bulk action.
    Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult:
      required:
        - id
        - skip_reason
      type: object
      properties:
        id:
          type: string
          description: ID of the skipped Knowledge Base Entry.
          example: '123'
        name:
          type: string
          description: Name of the skipped Knowledge Base Entry.
          example: Skipped Entry
        skip_reason:
          $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipReason'
    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResponse:
      required:
        - attributes
      type: object
      properties:
        attributes:
          required:
            - results
            - summary
          type: object
          properties:
            errors:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError'
              description: List of errors encountered during the bulk action.
              example:
                - err_code: UPDATE_FAILED
                  knowledgeBaseEntries:
                    - id: '456'
                      name: Error Entry
                  message: Failed to update entry.
                  statusCode: 400
            results:
              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults'
            summary:
              $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary'
        knowledgeBaseEntriesCount:
          type: integer
          description: Total number of Knowledge Base Entries processed.
          example: 8
        message:
          type: string
          description: Message describing the result of the bulk action.
          example: Bulk action completed successfully.
        statusCode:
          type: integer
          description: HTTP status code of the response.
          example: 200
        success:
          type: boolean
          description: Indicates whether the bulk action was successful.
          example: true
    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionResults:
      required:
        - updated
        - created
        - deleted
        - skipped
      type: object
      properties:
        created:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
          description: List of Knowledge Base Entries that were successfully created.
          example:
            - id: '456'
              kbResource: user
              name: New Entry
              source: manual
              text: This is the content of the new entry.
              type: document
        deleted:
          type: array
          items:
            type: string
          description: List of IDs of Knowledge Base Entries that were successfully deleted.
          example:
            - '789'
        skipped:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryBulkActionSkipResult'
          description: List of Knowledge Base Entries that were skipped during the bulk action.
          example:
            - id: '123'
              name: Skipped Entry
              skip_reason: KNOWLEDGE_BASE_ENTRY_NOT_MODIFIED
        updated:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryResponse'
          description: List of Knowledge Base Entries that were successfully updated.
          example:
            - id: '123'
              kbResource: user
              name: Updated Entry
              source: manual
              text: Updated content.
              type: document
    Security_AI_Assistant_API_KnowledgeBaseEntryBulkCrudActionSummary:
      required:
        - failed
        - skipped
        - succeeded
        - total
      type: object
      properties:
        failed:
          type: integer
          description: Number of Knowledge Base Entries that failed during the bulk action.
          example: 2
        skipped:
          type: integer
          description: Number of Knowledge Base Entries that were skipped during the bulk action.
          example: 1
        succeeded:
          type: integer
          description: Number of Knowledge Base Entries that were successfully processed during the bulk action.
          example: 5
        total:
          type: integer
          description: Total number of Knowledge Base Entries involved in the bulk action.
          example: 8
    Security_AI_Assistant_API_KnowledgeBaseEntryContentReference:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
        - required:
            - type
            - knowledgeBaseEntryId
            - knowledgeBaseEntryName
          type: object
          properties:
            knowledgeBaseEntryId:
              type: string
              description: Id of the Knowledge Base Entry
              example: kbentry456
            knowledgeBaseEntryName:
              type: string
              description: Name of the knowledge base entry
              example: Network Security Best Practices
            type:
              enum:
                - KnowledgeBaseEntry
              type: string
              example: KnowledgeBaseEntry
      description: References a knowledge base entry
    Security_AI_Assistant_API_KnowledgeBaseEntryCreateProps:
      anyOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
      discriminator:
        propertyName: type
        mapping:
          document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
          index: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
    Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError:
      required:
        - id
      type: object
      properties:
        id:
          type: string
          description: ID of the Knowledge Base Entry that encountered an error.
          example: '456'
        name:
          type: string
          description: Name of the Knowledge Base Entry that encountered an error.
          example: Error Entry
    Security_AI_Assistant_API_KnowledgeBaseEntryErrorSchema:
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          description: Error type or category.
          example: Not Found
        message:
          type: string
          description: Detailed error message.
          example: The requested Knowledge Base Entry was not found.
        statusCode:
          type: number
          description: HTTP status code of the error.
          example: 404
      additionalProperties: false
    Security_AI_Assistant_API_KnowledgeBaseEntryResponse:
      anyOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
      discriminator:
        propertyName: type
        mapping:
          document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntry'
          index: '#/components/schemas/Security_AI_Assistant_API_IndexEntry'
    Security_AI_Assistant_API_KnowledgeBaseEntryUpdateProps:
      anyOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
      discriminator:
        propertyName: type
        mapping:
          document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryUpdateFields'
          index: '#/components/schemas/Security_AI_Assistant_API_IndexEntryUpdateFields'
    Security_AI_Assistant_API_KnowledgeBaseEntryUpdateRouteProps:
      anyOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
        - $ref: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
      discriminator:
        propertyName: type
        mapping:
          document: '#/components/schemas/Security_AI_Assistant_API_DocumentEntryCreateFields'
          index: '#/components/schemas/Security_AI_Assistant_API_IndexEntryCreateFields'
    Security_AI_Assistant_API_KnowledgeBaseReadResponse200:
      type: object
      properties:
        defend_insights_exists:
          type: boolean
          description: Indicates if Defend Insights documentation exists in the KnowledgeBase.
          example: true
        elser_exists:
          type: boolean
          description: Indicates if the ELSER model exists for the KnowledgeBase.
          example: true
        is_setup_available:
          type: boolean
          description: Indicates if the setup process is available for the KnowledgeBase.
          example: true
        is_setup_in_progress:
          type: boolean
          description: Indicates if the setup process is currently in progress.
          example: false
        product_documentation_status:
          type: string
          description: The status of the product documentation in the KnowledgeBase.
          example: complete
        security_labs_exists:
          type: boolean
          description: Indicates if Security Labs documentation exists in the KnowledgeBase.
          example: true
        user_data_exists:
          type: boolean
          description: Indicates if user data exists in the KnowledgeBase.
          example: false
    Security_AI_Assistant_API_KnowledgeBaseResource:
      enum:
        - security_labs
        - defend_insights
        - user
      type: string
      description: 'Knowledge Base resource name for grouping entries, e.g. ''security_labs'', ''user'', etc.'
      example: security_labs
    Security_AI_Assistant_API_KnowledgeBaseResponse:
      type: object
      properties:
        success:
          type: boolean
          description: Identify the success of the method execution.
          example: true
      description: AI assistant KnowledgeBase.
    Security_AI_Assistant_API_KnowledgeBaseResponse400:
      type: object
      properties:
        error:
          type: string
          description: A short description of the error.
          example: Bad Request
        message:
          type: string
          description: A detailed error message.
          example: Invalid resource ID provided.
        statusCode:
          type: number
          description: The HTTP status code of the error.
          example: 400
    Security_AI_Assistant_API_Message:
      required:
        - timestamp
        - content
        - role
      type: object
      properties:
        content:
          type: string
          description: Message content.
          example: 'Hello, how can I assist you today?'
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        isError:
          type: boolean
          description: Is error message.
          example: false
        metadata:
          $ref: '#/components/schemas/Security_AI_Assistant_API_MessageMetadata'
        reader:
          $ref: '#/components/schemas/Security_AI_Assistant_API_Reader'
        refusal:
          type: string
          description: Refusal reason returned by the model when content is filtered.
        role:
          $ref: '#/components/schemas/Security_AI_Assistant_API_MessageRole'
        timestamp:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
        traceData:
          $ref: '#/components/schemas/Security_AI_Assistant_API_TraceData'
        user:
          $ref: '#/components/schemas/Security_AI_Assistant_API_User'
      description: AI assistant conversation message.
    Security_AI_Assistant_API_MessageData:
      type: object
      description: ECS-style metadata attached to the message.
      example:
        alert_id: alert-456
        user_id: abc123
    Security_AI_Assistant_API_MessageMetadata:
      type: object
      properties:
        contentReferences:
          $ref: '#/components/schemas/Security_AI_Assistant_API_ContentReferences'
        interruptResumeValue:
          $ref: '#/components/schemas/Security_AI_Assistant_API_InterruptResumeValue'
        interruptValue:
          $ref: '#/components/schemas/Security_AI_Assistant_API_InterruptValue'
      description: Message metadata
    Security_AI_Assistant_API_MessageRole:
      enum:
        - system
        - user
        - assistant
      type: string
      description: Message role.
      example: assistant
    Security_AI_Assistant_API_NonEmptyString:
      minLength: 1
      type: string
      description: A string that does not contain only whitespace characters.
      format: nonempty
      example: I am a string
    Security_AI_Assistant_API_NonEmptyTimestamp:
      minLength: 1
      type: string
      description: A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
      format: nonempty
      example: '2023-10-31T12:00:00Z'
    Security_AI_Assistant_API_NormalizedAnonymizationFieldError:
      required:
        - message
        - status_code
        - anonymization_fields
      type: object
      properties:
        anonymization_fields:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_AnonymizationFieldDetailsInError'
          description: Array of anonymization fields that caused the error.
        err_code:
          type: string
          description: Error code indicating the type of failure.
          example: UPDATE_FAILED
        message:
          type: string
          description: Error message.
          example: Failed to update anonymization field.
        status_code:
          type: integer
          description: Status code of the response.
          example: 400
    Security_AI_Assistant_API_NormalizedKnowledgeBaseEntryError:
      required:
        - message
        - statusCode
        - knowledgeBaseEntries
      type: object
      properties:
        err_code:
          type: string
          description: Specific error code for the issue.
          example: UPDATE_FAILED
        knowledgeBaseEntries:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_KnowledgeBaseEntryDetailsInError'
          description: List of Knowledge Base Entries that encountered the error.
        message:
          type: string
          description: Error message describing the issue.
          example: Failed to update entry.
        statusCode:
          type: integer
          description: HTTP status code associated with the error.
          example: 400
    Security_AI_Assistant_API_NormalizedPromptError:
      required:
        - message
        - status_code
        - prompts
      type: object
      properties:
        err_code:
          type: string
          description: A code representing the error type.
        message:
          type: string
          description: A message describing the error encountered.
        prompts:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_PromptDetailsInError'
          description: List of prompts that encountered errors.
        status_code:
          type: integer
          description: The HTTP status code associated with the error.
    Security_AI_Assistant_API_ProductDocumentationContentReference:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
        - required:
            - type
            - title
            - url
          type: object
          properties:
            title:
              type: string
              description: Title of the documentation
              example: Getting Started with Security AI Assistant
            type:
              enum:
                - ProductDocumentation
              type: string
              example: ProductDocumentation
            url:
              type: string
              description: URL to the documentation
              example: https://docs.example.com/security-ai-assistant
      description: References the product documentation
    Security_AI_Assistant_API_PromptCreateProps:
      required:
        - name
        - content
        - promptType
      type: object
      properties:
        categories:
          type: array
          items:
            type: string
          description: List of categories for the prompt.
          example:
            - security
            - verification
        color:
          type: string
          description: The color associated with the prompt.
          example: blue
        consumer:
          type: string
          description: The consumer associated with the prompt.
          example: admin
        content:
          type: string
          description: The content of the prompt.
          example: Please verify the security settings.
        isDefault:
          type: boolean
          description: Whether this prompt should be the default.
          example: false
        isNewConversationDefault:
          type: boolean
          description: Whether this prompt should be the default for new conversations.
          example: true
        name:
          type: string
          description: The name of the prompt.
          example: New Security Prompt
        promptType:
          $ref: '#/components/schemas/Security_AI_Assistant_API_PromptType'
    Security_AI_Assistant_API_PromptDetailsInError:
      required:
        - id
      type: object
      properties:
        id:
          type: string
          description: The ID of the prompt that encountered an error.
        name:
          type: string
          description: The name of the prompt that encountered an error.
    Security_AI_Assistant_API_PromptResponse:
      required:
        - id
        - name
        - promptType
        - content
      type: object
      properties:
        categories:
          type: array
          items:
            type: string
          description: Categories associated with the prompt.
        color:
          type: string
          description: The color associated with the prompt.
        consumer:
          type: string
          description: The consumer that the prompt is associated with.
        content:
          type: string
          description: The content of the prompt.
        createdAt:
          type: string
          description: The timestamp of when the prompt was created.
        createdBy:
          type: string
          description: The user who created the prompt.
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        isDefault:
          type: boolean
          description: Whether this prompt is the default.
        isNewConversationDefault:
          type: boolean
          description: Whether this prompt is the default for new conversations.
        name:
          type: string
          description: The name of the prompt.
        namespace:
          type: string
          description: Kibana space where the prompt is located.
        promptType:
          $ref: '#/components/schemas/Security_AI_Assistant_API_PromptType'
        timestamp:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyTimestamp'
        updatedAt:
          type: string
          description: The timestamp of when the prompt was last updated.
        updatedBy:
          type: string
          description: The user who last updated the prompt.
        users:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_User'
          description: List of users associated with the prompt.
    Security_AI_Assistant_API_PromptsBulkActionSkipReason:
      enum:
        - PROMPT_FIELD_NOT_MODIFIED
      type: string
      description: Reason why a prompt was skipped during the bulk action.
    Security_AI_Assistant_API_PromptsBulkActionSkipResult:
      required:
        - id
        - skip_reason
      type: object
      properties:
        id:
          type: string
          description: The ID of the prompt that was skipped.
        name:
          type: string
          description: The name of the prompt that was skipped.
        skip_reason:
          $ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipReason'
    Security_AI_Assistant_API_PromptsBulkCrudActionResponse:
      required:
        - attributes
      type: object
      properties:
        attributes:
          required:
            - results
            - summary
          type: object
          properties:
            errors:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_NormalizedPromptError'
            results:
              $ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkCrudActionResults'
            summary:
              $ref: '#/components/schemas/Security_AI_Assistant_API_BulkCrudActionSummary'
        message:
          type: string
          description: A message describing the result of the bulk action.
          example: Bulk action completed successfully.
        prompts_count:
          type: integer
          description: The number of prompts processed in the bulk action.
          example: 6
        status_code:
          type: integer
          description: The HTTP status code of the response.
          example: 200
        success:
          type: boolean
          description: Indicates if the bulk action was successful.
          example: true
    Security_AI_Assistant_API_PromptsBulkCrudActionResults:
      required:
        - updated
        - created
        - deleted
        - skipped
      type: object
      properties:
        created:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
          description: List of prompts that were created.
        deleted:
          type: array
          items:
            type: string
          description: List of IDs of prompts that were deleted.
        skipped:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_PromptsBulkActionSkipResult'
          description: List of prompts that were skipped.
        updated:
          type: array
          items:
            $ref: '#/components/schemas/Security_AI_Assistant_API_PromptResponse'
          description: List of prompts that were updated.
    Security_AI_Assistant_API_PromptType:
      enum:
        - system
        - quick
      type: string
      description: Type of the prompt (either system or quick).
    Security_AI_Assistant_API_PromptUpdateProps:
      required:
        - id
      type: object
      properties:
        categories:
          type: array
          items:
            type: string
          description: The updated categories for the prompt.
          example:
            - security
            - alert
        color:
          type: string
          description: The updated color associated with the prompt.
          example: green
        consumer:
          type: string
          description: The updated consumer for the prompt.
          example: user123
        content:
          type: string
          description: The updated content for the prompt.
          example: Updated content for security prompt.
        id:
          type: string
          description: The ID of the prompt to update.
          example: prompt123
        isDefault:
          type: boolean
          description: Whether this prompt should be the default.
          example: true
        isNewConversationDefault:
          type: boolean
          description: Whether the prompt should be the default for new conversations.
          example: false
    Security_AI_Assistant_API_Provider:
      enum:
        - OpenAI
        - Azure OpenAI
        - Other
      type: string
      description: Provider
      example: OpenAI
    Security_AI_Assistant_API_Reader:
      type: object
    Security_AI_Assistant_API_Replacements:
      type: object
      additionalProperties:
        type: string
      description: Replacements object used to anonymize/deanonymize messages
    Security_AI_Assistant_API_ResponseFields:
      required:
        - id
        - createdAt
        - createdBy
        - updatedAt
        - updatedBy
      type: object
      properties:
        createdAt:
          type: string
          description: Time the Knowledge Base Entry was created.
          example: '2023-01-01T12:00:00Z'
        createdBy:
          type: string
          description: User who created the Knowledge Base Entry.
          example: admin
        id:
          $ref: '#/components/schemas/Security_AI_Assistant_API_NonEmptyString'
        updatedAt:
          type: string
          description: Time the Knowledge Base Entry was last updated.
          example: '2023-01-02T12:00:00Z'
        updatedBy:
          type: string
          description: User who last updated the Knowledge Base Entry.
          example: editor
    Security_AI_Assistant_API_SecurityAlertContentReference:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
        - required:
            - type
            - alertId
          type: object
          properties:
            alertId:
              type: string
              description: ID of the Alert
              example: alert789
            type:
              enum:
                - SecurityAlert
              type: string
              example: SecurityAlert
      description: References a security alert
    Security_AI_Assistant_API_SecurityAlertsPageContentReference:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseContentReference'
        - required:
            - type
          type: object
          properties:
            type:
              enum:
                - SecurityAlertsPage
              type: string
              example: SecurityAlertsPage
      description: References the security alerts page
    Security_AI_Assistant_API_SelectOptionInterruptOption:
      required:
        - label
        - value
      type: object
      properties:
        buttonColor:
          enum:
            - text
            - accent
            - accentSecondary
            - primary
            - success
            - warning
            - danger
            - neutral
            - risk
          type: string
          example: danger
        label:
          type: string
          example: Option 1
        value:
          type: string
          example: option_1
      description: A request approval option
    Security_AI_Assistant_API_SelectOptionInterruptResumeValue:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptResumeValue'
        - required:
            - value
            - type
          type: object
          properties:
            type:
              enum:
                - SELECT_OPTION
              type: string
              example: SELECT_OPTION
            value:
              type: string
              description: The value of the selected option to resume the graph execution with
              example: option_1
      description: A request approval resume schema
    Security_AI_Assistant_API_SelectOptionInterruptValue:
      allOf:
        - $ref: '#/components/schemas/Security_AI_Assistant_API_BaseInterruptValue'
        - required:
            - type
            - description
            - options
          type: object
          properties:
            description:
              type: string
              description: Description of action required
              example: Select one of the options
            options:
              type: array
              items:
                $ref: '#/components/schemas/Security_AI_Assistant_API_SelectOptionInterruptOption'
              description: List of actions to choose from
              example:
                - label: Option 1
                - label: Option 2
            type:
              enum:
                - SELECT_OPTION
              type: string
              example: SELECT_OPTION
      description: Interrupt that requests user to select one of the provided options
    Security_AI_Assistant_API_SortOrder:
      enum:
        - asc
        - desc
      type: string
      description: The order in which results are sorted.
      example: asc
    Security_AI_Assistant_API_TraceData:
      type: object
      properties:
        traceId:
          type: string
          description: 'Could be any string, not necessarily a UUID'
          example: d9876543-f0a1-2345-6789-abcdef123456
        transactionId:
          type: string
          description: 'Could be any string, not necessarily a UUID'
          example: a1234567-bc89-0def-1234-56789abcdef0
      description: Trace Data
    Security_AI_Assistant_API_User:
      type: object
      properties:
        id:
          type: string
          description: User id.
          example: user123
        name:
          type: string
          description: User name.
          example: John Doe
      description: 'Could be any string, not necessarily a UUID.'
    Security_AI_Assistant_API_Vector:
      required:
        - modelId
        - tokens
      type: object
      properties:
        modelId:
          type: string
          description: ID of the model used to create the embeddings.
          example: bert-base-uncased
        tokens:
          type: object
          additionalProperties:
            type: number
          description: Tokens with their corresponding values.
          example:
            token1: 0.123
            token2: 0.456
      description: Object containing Knowledge Base Entry text embeddings and modelId used to create the embeddings.
    Security_Attack_discovery_API_AnonymizationFieldResponse:
      required:
        - id
        - field
      type: object
      properties:
        allowed:
          type: boolean
          description: Whether this field is allowed to be sent to the model.
          example: true
        anonymized:
          type: boolean
          description: Whether this field should be anonymized.
          example: false
        createdAt:
          type: string
          description: Timestamp of when the anonymization field was created.
          example: '2023-10-31T12:00:00Z'
        createdBy:
          type: string
          description: Username of the person who created the anonymization field.
          example: user1
        field:
          type: string
          description: Name of the anonymization field.
          example: url.domain
        id:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
        namespace:
          type: string
          description: Kibana space in which this anonymization field exists.
          example: default
        timestamp:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyTimestamp'
        updatedAt:
          type: string
          description: Timestamp of the last update.
          example: '2023-10-31T12:00:00Z'
        updatedBy:
          type: string
          description: Username of the person who last updated the field.
          example: user1
    Security_Attack_discovery_API_ApiConfig:
      required:
        - connectorId
        - actionTypeId
      type: object
      properties:
        actionTypeId:
          type: string
          description: Action type ID
          example: actionType456
        connectorId:
          type: string
          description: Connector ID
          example: connector123
        defaultSystemPromptId:
          type: string
          description: Default system prompt ID
          example: systemPrompt001
        model:
          type: string
          description: Model
          example: gpt-4
        provider:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Provider'
    Security_Attack_discovery_API_AttackDiscoveryApiAlert:
      required:
        - alert_ids
        - connector_id
        - connector_name
        - details_markdown
        - generation_uuid
        - id
        - summary_markdown
        - timestamp
        - title
      type: object
      properties:
        alert_ids:
          type: array
          items:
            type: string
          description: The alert IDs that the attack discovery is based on
        alert_rule_uuid:
          type: string
          description: The optional kibana.alert.rule.uuid of the rule that generated this attack discovery (not applicable to ad hock runs)
        alert_start:
          type: string
          description: The optional time the attack discovery alert was created
        alert_updated_at:
          type: string
          description: The optional time the attack discovery alert was last updated
        alert_updated_by_user_id:
          type: string
          description: The optional id of the user who last updated the attack discovery alert
        alert_updated_by_user_name:
          type: string
          description: The optional username of the user who updated the attack discovery alert
        alert_workflow_reason:
          type: string
          description: 'The optional kibana.alert.workflow_reason of this attack discovery, which records why the workflow status was last changed'
        alert_workflow_status:
          type: string
          description: The optional kibana.alert.workflow_status of this attack discovery
        alert_workflow_status_updated_at:
          type: string
          description: The optional time the attack discovery alert workflow status was last updated
        assignees:
          type: array
          items:
            type: string
          description: The optional array of user-IDs who have been assigned the attack
        connector_id:
          type: string
          description: The ID of the connector that generated the attack discovery
        connector_name:
          type: string
          description: The (human readable) name of the connector that generated the attack discovery
        details_markdown:
          type: string
          description: Details of the attack with bulleted markdown that always uses special syntax for field names and values from the source data.
        entity_summary_markdown:
          type: string
          description: 'An optional, short (no more than a sentence) summary of the attack discovery featuring only the host.name and user.name fields (when they are applicable), using the same syntax'
        generation_uuid:
          type: string
          description: The generation ID of the run that created the attack discovery
        id:
          type: string
          description: The unique ID of the attack discovery
        index:
          type: string
          description: The concrete Elasticsearch index where this attack discovery is stored
        mitre_attack_tactics:
          type: array
          items:
            type: string
          description: An optional array of MITRE ATT&CK tactic for the attack discovery
        replacements:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Replacements'
        risk_score:
          type: integer
          description: 'The optional, (but typically populated after generation) risk score of the alert'
        summary_markdown:
          type: string
          description: 'A markdown summary of attack discovery, using the same syntax'
        tags:
          type: array
          items:
            type: string
          description: The optional array of tags assigned the attack
        timestamp:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyTimestamp'
        title:
          type: string
          description: 'A title for the attack discovery, in plain text'
        user_id:
          type: string
          description: The optional id of the user who generated the attack discovery
        user_name:
          type: string
          description: 'The optional username of the user who generated the attack discovery, (not applicable to attack discoveries generated by rules)'
        users:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_User'
          description: 'The optional array of users who may view the attack discovery. When empty, (or not present), all users may view the attack discovery.'
      description: An attack discovery that's also an alert (Public API with snake_case)
    Security_Attack_discovery_API_AttackDiscoveryApiSchedule:
      required:
        - id
        - name
        - created_by
        - updated_by
        - created_at
        - updated_at
        - enabled
        - params
        - schedule
        - actions
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction'
          description: The Attack Discovery schedule actions
        created_at:
          type: string
          description: The date the schedule was created
          format: date-time
        created_by:
          type: string
          description: The name of the user that created the schedule
        enabled:
          type: boolean
          description: Indicates whether the schedule is enabled
        id:
          type: string
          description: UUID of Attack Discovery schedule
        last_execution:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution'
        name:
          type: string
          description: The name of the schedule
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams'
        schedule:
          $ref: '#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule'
        updated_at:
          type: string
          description: The date the schedule was updated
          format: date-time
        updated_by:
          type: string
          description: The name of the user that updated the schedule
      description: An Attack Discovery schedule
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction:
      oneOf:
        - $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction'
        - $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter:
      type: object
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency:
      required:
        - summary
        - notify_when
        - throttle
      type: object
      properties:
        notify_when:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen'
        summary:
          type: boolean
          description: Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
        throttle:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle'
      description: 'The action frequency defines when the action runs (for example, only on schedule execution or at specific time intervals).'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup:
      type: string
      description: Groups actions by use cases. Use `default` for alert notifications.
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId:
      type: string
      description: The connector ID.
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionNotifyWhen:
      enum:
        - onActiveAlert
        - onThrottleInterval
        - onActionGroupChange
      type: string
      description: 'The condition for throttling the notification: `onActionGroupChange`, `onActiveAlert`,  or `onThrottleInterval`'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams:
      type: object
      description: 'Object containing the allowed connector fields, which varies according to the connector type.'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionThrottle:
      pattern: '^[1-9]\d*[smhd]$'
      type: string
      description: 'Defines how often schedule actions are taken. Time interval in seconds, minutes, hours, or days.'
      example: 1h
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleCreateProps:
      required:
        - name
        - params
        - schedule
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction'
          description: The Attack Discovery schedule actions
        enabled:
          type: boolean
          description: Indicates whether the schedule is enabled
        name:
          type: string
          description: The name of the schedule
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams'
        schedule:
          $ref: '#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule'
      description: An Attack Discovery schedule create properties
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecution:
      required:
        - date
        - status
        - last_duration
      type: object
      properties:
        date:
          type: string
          description: Date of the execution
          format: date-time
        duration:
          type: number
          description: Duration of the execution
        message:
          type: string
        status:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus'
      description: An Attack Discovery schedule execution information
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleExecutionStatus:
      enum:
        - ok
        - active
        - error
        - unknown
        - warning
      type: string
      description: An Attack Discovery schedule execution status
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleGeneralAction:
      required:
        - action_type_id
        - group
        - id
        - params
      type: object
      properties:
        action_type_id:
          type: string
          description: The action type used for sending notifications.
        alerts_filter:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionAlertsFilter'
        frequency:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionFrequency'
        group:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionGroup'
        id:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId'
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams'
        uuid:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams:
      required:
        - alerts_index_pattern
        - api_config
        - size
      type: object
      properties:
        alerts_index_pattern:
          type: string
          description: The index pattern to get alerts from
        api_config:
          allOf:
            - $ref: '#/components/schemas/Security_Attack_discovery_API_ApiConfig'
            - required:
                - name
              type: object
              properties:
                name:
                  type: string
                  description: The name of the connector
          description: LLM API configuration.
        combined_filter:
          type: object
        end:
          type: string
        filters:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Filters'
        query:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Query'
        size:
          type: number
        start:
          type: string
      description: An Attack Discovery schedule params
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleSystemAction:
      required:
        - action_type_id
        - id
        - params
      type: object
      properties:
        action_type_id:
          type: string
          description: The action type used for sending notifications.
        id:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionId'
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleActionParams'
        uuid:
          $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
    Security_Attack_discovery_API_AttackDiscoveryApiScheduleUpdateProps:
      required:
        - name
        - params
        - schedule
        - actions
      type: object
      properties:
        actions:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleAction'
          description: The Attack Discovery schedule actions
        name:
          type: string
          description: The name of the schedule
        params:
          $ref: '#/components/schemas/Security_Attack_discovery_API_AttackDiscoveryApiScheduleParams'
        schedule:
          $ref: '#/components/schemas/Security_Attack_discovery_API_IntervalApiSchedule'
      description: An Attack Discovery schedule update properties
    Security_Attack_discovery_API_AttackDiscoveryFindSortField:
      enum:
        - '@timestamp'
      type: string
      description: Allowed field names to sort Attack Discovery results by. Clients should only pass one of the listed values.
    Security_Attack_discovery_API_AttackDiscoveryGeneration:
      required:
        - connector_id
        - discoveries
        - execution_uuid
        - start
        - status
      type: object
      properties:
        alerts_context_count:
          type: number
          description: The number of alerts sent as context (max kibana.alert.rule.execution.metrics.alert_counts.active) to the LLM for the generation
        connector_id:
          type: string
          description: The connector id (event.dataset) for this generation
        connector_stats:
          type: object
          properties:
            average_successful_duration_nanoseconds:
              type: number
              description: 'The average duration (avg event.duration) in nanoseconds of successful generations for the same connector id, for the current user'
            successful_generations:
              type: number
              description: 'The number of successful generations for the same connector id, for the current user'
          description: Stats applicable to the connector for this generation
        conversation_id:
          type: string
          description: Identifier of the persisted Agent Builder conversation for skill-based alert retrieval (optional; present only when the skill retrieval mode ran)
        discoveries:
          type: number
          description: The number of new Attack discovery alerts (max kibana.alert.rule.execution.metrics.alert_counts.new) for this generation
        duplicates_dropped_count:
          type: integer
          description: The number of attack discoveries dropped as duplicates during the persist step
        end:
          type: string
          description: When generation ended (max event.end)
        error_category:
          type: string
          description: Structured error category from server classification (optional; absent for successful generations)
        execution_uuid:
          type: string
          description: The unique identifier (kibana.alert.rule.execution.uuid) for the generation
        failed_workflow_id:
          type: string
          description: Workflow ID that caused the failure (optional; absent for successful generations)
        generated_count:
          type: integer
          description: The number of attack discoveries generated before deduplication and hallucination filtering
        hallucinations_filtered_count:
          type: integer
          description: The number of attack discoveries filtered as hallucinations during the validation step
        loading_message:
          type: string
          description: Generation loading message (kibana.alert.rule.execution.status)
        persisted_count:
          type: integer
          description: The number of attack discoveries successfully persisted after deduplication and hallucination filtering
        reason:
          type: string
          description: Reason for failed generations (event.reason)
        source_metadata:
          type:
            - 'null'
            - object
          properties:
            action_execution_uuid:
              type: string
              description: The action execution UUID from the alerting framework
            rule_id:
              type: string
              description: The ID of the alerting rule that triggered this generation
            rule_name:
              type: string
              description: The name of the alerting rule that triggered this generation
          description: 'Source metadata for scheduled generations (rule_id, rule_name, action_execution_uuid)'
        start:
          type: string
          description: When generation started (min event.start)
        status:
          enum:
            - canceled
            - dismissed
            - failed
            - started
            - succeeded
          type: string
          description: The status of the attack discovery generation
        step_event_actions:
          type: array
          items:
            type: string
          description: 'Synthesized per-step lifecycle markers (e.g. step-start, step-complete, step-fail) derived from raw event.action values. The array is ordered by step sequence (alert retrieval, generation, validation), with each step contributing 0-2 tokens that indicate its execution status.'
        workflow_executions:
          $ref: '#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionsTracking'
        workflow_id:
          type: string
          description: The workflow definition ID for deep linking
        workflow_run_id:
          type: string
          description: The workflow execution ID for monitoring
    Security_Attack_discovery_API_AttackDiscoveryGenerationConfig:
      required:
        - apiConfig
        - alertsIndexPattern
        - anonymizationFields
        - size
        - subAction
      type: object
      properties:
        alertsIndexPattern:
          type: string
          description: "The (space specific) index pattern that contains the alerts to use as\ncontext for the attack discovery.\nExample: .alerts-security.alerts-default\n"
        anonymizationFields:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_AnonymizationFieldResponse'
          description: 'The list of fields, and whether or not they are anonymized, allowed to be sent to LLMs. Consider using the output of the `/api/security_ai_assistant/anonymization_fields/_find` API (for a specific Kibana space) to provide this value.'
        apiConfig:
          $ref: '#/components/schemas/Security_Attack_discovery_API_ApiConfig'
        connectorName:
          type: string
        end:
          type: string
        filter:
          type: object
          description: "An Elasticsearch-style query DSL object used to filter alerts. For example:\n```json {\n  \"filter\": {\n    \"bool\": {\n      \"must\": [],\n      \"filter\": [\n        {\n          \"bool\": {\n            \"should\": [\n              {\n                \"term\": {\n                  \"user.name\": { \"value\": \"james\" }\n                }\n              }\n            ],\n            \"minimum_should_match\": 1\n          }\n        }\n      ],\n      \"should\": [],\n      \"must_not\": []\n    }\n  }\n} ```"
        model:
          type: string
        replacements:
          $ref: '#/components/schemas/Security_Attack_discovery_API_Replacements'
        size:
          type: number
        start:
          type: string
        subAction:
          enum:
            - invokeAI
            - invokeStream
          type: string
    Security_Attack_discovery_API_AttackDiscoveryGenericError:
      type: object
      properties:
        error:
          type: string
          description: Error type
          example: Bad Request
        message:
          type: string
          description: Human-readable error message describing what went wrong
          example: Invalid request parameters.
        status_code:
          type: number
          description: HTTP status code
          example: 400
      description: 'Error response for Attack discovery schedule operations when the request is rejected. Uses `status_code` (snake_case), `error`, and `message` to match the implementation.'
    Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesError:
      required:
        - message
        - rule
      type: object
      properties:
        message:
          type: string
          description: The error message returned for the failed schedule.
        rule:
          required:
            - id
            - name
          type: object
          properties:
            id:
              $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
            name:
              type: string
              description: The name of the failed schedule.
        status:
          type: number
          description: Optional HTTP status associated with the failed schedule operation.
    Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesRequestBody:
      required:
        - ids
      type: object
      properties:
        ids:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          description: The unique identifiers of the Attack Discovery schedules to update.
    Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesResponse:
      required:
        - ids
        - errors
        - total
      type: object
      properties:
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_BulkActionAttackDiscoverySchedulesError'
        ids:
          type: array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_NonEmptyString'
          description: The unique identifiers of the schedules successfully affected by the bulk action.
        total:
          type: number
          description: The total number of schedules matched by the bulk action.
    Security_Attack_discovery_API_Filters:
      type: array
      items: { }
      description: The filter array used to define the conditions for when alerts are selected as an Attack Discovery context. Defaults to an empty array.
    Security_Attack_discovery_API_IntervalApiSchedule:
      required:
        - interval
      type: object
      properties:
        interval:
          type: string
          description: The schedule interval
    Security_Attack_discovery_API_NonEmptyString:
      minLength: 1
      type: string
      description: A string that does not contain only whitespace characters.
      format: nonempty
      example: I am a string
    Security_Attack_discovery_API_NonEmptyTimestamp:
      minLength: 1
      type: string
      description: A string that represents a timestamp in ISO 8601 format and does not contain only whitespace characters.
      format: nonempty
      example: '2023-10-31T12:00:00Z'
    Security_Attack_discovery_API_Provider:
      enum:
        - OpenAI
        - Azure OpenAI
        - Other
      type: string
      description: Provider
      example: OpenAI
    Security_Attack_discovery_API_Query:
      required:
        - query
        - language
      type: object
      properties:
        language:
          type: string
        query:
          type:
            - string
            - object
      description: An query condition to filter alerts
    Security_Attack_discovery_API_Replacements:
      type: object
      additionalProperties:
        type: string
      description: Replacements object used to anonymize/deanonymize messages
    Security_Attack_discovery_API_SortOrder:
      enum:
        - asc
        - desc
      type: string
      description: The order in which results are sorted.
      example: asc
    Security_Attack_discovery_API_User:
      type: object
      properties:
        id:
          type: string
          description: User id.
          example: user123
        name:
          type: string
          description: User name.
          example: John Doe
      description: 'Could be any string, not necessarily a UUID.'
    Security_Attack_discovery_API_WorkflowExecutionReference:
      required:
        - workflowId
        - workflowRunId
      type: object
      properties:
        workflowId:
          type: string
          description: The workflow definition ID
        workflowName:
          type: string
          description: The human-readable workflow name (optional; used by the UI to display a label)
        workflowRunId:
          type: string
          description: The workflow execution ID
    Security_Attack_discovery_API_WorkflowExecutionsTracking:
      type: object
      properties:
        alertRetrieval:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference'
          description: Alert retrieval workflow executions (one per workflow invoked)
        gate:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference'
          description: 'Generation-phase gate (skill) executions, including any net-new alert re-fetch the skill triggers'
        generation:
          $ref: '#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference'
        validation:
          $ref: '#/components/schemas/Security_Attack_discovery_API_WorkflowExecutionReference'
      description: Workflow execution tracking for manual orchestration
    Security_Detections_API_AlertAssignees:
      required:
        - add
        - remove
      type: object
      properties:
        add:
          type: array
          items:
            minLength: 1
            type: string
            description: A list of user profile `uid`s to assign. Users need to activate their user profile by logging into Kibana at least once.
            format: nonempty
        remove:
          type: array
          items:
            minLength: 1
            type: string
            description: A list of user profile `uid`s to unassign. Users need to activate their user profile by logging into Kibana at least once.
            format: nonempty
    Security_Detections_API_AlertIds:
      minItems: 1
      type: array
      items:
        minLength: 1
        type: string
        format: nonempty
      description: A list of alerts `id`s.
    Security_Detections_API_AlertsIndex:
      type: string
      description: (deprecated) Has no effect.
      deprecated: true
    Security_Detections_API_AlertsIndexMigrationError:
      required:
        - index
        - error
      type: object
      properties:
        error:
          required:
            - message
            - status_code
          type: object
          properties:
            message:
              type: string
            status_code:
              type: string
        index:
          type: string
    Security_Detections_API_AlertsIndexMigrationSuccess:
      required:
        - index
        - migration_id
        - migration_index
      type: object
      properties:
        index:
          type: string
        migration_id:
          type: string
        migration_index:
          type: string
    Security_Detections_API_AlertsIndexNamespace:
      type: string
      description: Has no effect.
    Security_Detections_API_AlertsReindexOptions:
      type: object
      properties:
        requests_per_second:
          minimum: 1
          type: integer
          description: The throttle for the migration task in sub-requests per second. Corresponds to requests_per_second on the Reindex API.
        size:
          minimum: 1
          type: integer
          description: Number of alerts to migrate per batch. Corresponds to the source.size option on the Reindex API.
        slices:
          minimum: 1
          type: integer
          description: The number of subtasks for the migration task. Corresponds to slices on the Reindex API.
    Security_Detections_API_AlertsSort:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_AlertsSortCombinations'
        - type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_AlertsSortCombinations'
    Security_Detections_API_AlertsSortCombinations:
      type:
        - string
        - object
    Security_Detections_API_AlertStatusExceptClosed:
      enum:
        - open
        - acknowledged
        - in-progress
      type: string
      description: 'The status of an alert, which can be `open`, `acknowledged`, `in-progress`, or `closed`.'
    Security_Detections_API_AlertSuppression:
      required:
        - group_by
      type: object
      properties:
        duration:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDuration'
        group_by:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionGroupBy'
        missing_fields_strategy:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionMissingFieldsStrategy'
      description: Defines alert suppression configuration.
    Security_Detections_API_AlertSuppressionDuration:
      required:
        - value
        - unit
      type: object
      properties:
        unit:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDurationUnit'
        value:
          minimum: 1
          type: integer
    Security_Detections_API_AlertSuppressionDurationUnit:
      enum:
        - s
        - m
        - h
      type: string
      description: Time unit
    Security_Detections_API_AlertSuppressionGroupBy:
      maxItems: 3
      minItems: 1
      type: array
      items:
        type: string
    Security_Detections_API_AlertSuppressionMissingFieldsStrategy:
      enum:
        - doNotSuppress
        - suppress
      type: string
      description: "Describes how alerts will be generated for documents with missing suppress by fields:\ndoNotSuppress - per each document a separate alert will be created\nsuppress - only alert will be created per suppress by bucket"
    Security_Detections_API_AlertTag:
      minLength: 1
      type: string
      description: Use alert tags to organize related alerts into categories that you can filter and group.
      format: nonempty
    Security_Detections_API_AlertTags:
      type: array
      items:
        $ref: '#/components/schemas/Security_Detections_API_AlertTag'
      description: List of keywords to organize related alerts into categories that you can filter and group.
    Security_Detections_API_AlertVersion:
      required:
        - version
        - count
      type: object
      properties:
        count:
          type: integer
        version:
          type: integer
    Security_Detections_API_AnomalyThreshold:
      minimum: 0
      type: integer
      description: Anomaly score threshold above which the rule creates an alert. Valid values are from 0 to 100.
    Security_Detections_API_BuildingBlockType:
      type: string
      description: "Determines if the rule acts as a building block. If yes, the value must be `default`.\nBy default, building-block alerts are not displayed in the UI. These rules are used as a foundation for other rules that do generate alerts.\nFor more information, refer to [About building block rules](https://www.elastic.co/docs/solutions/security/detect-and-alert/about-building-block-rules).\n"
    Security_Detections_API_BulkActionEditPayload:
      anyOf:
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadTags'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadIndexPatterns'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadInvestigationFields'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadTimeline'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadRuleActions'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSchedule'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadAlertSuppression'
    Security_Detections_API_BulkActionEditPayloadAlertSuppression:
      anyOf:
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppression'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold'
        - $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression'
    Security_Detections_API_BulkActionEditPayloadDeleteAlertSuppression:
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - delete_alert_suppression
          type: string
    Security_Detections_API_BulkActionEditPayloadIndexPatterns:
      required:
        - type
        - value
      type: object
      properties:
        overwrite_data_views:
          type: boolean
          description: Resets the data view for the rule.
        type:
          enum:
            - add_index_patterns
            - delete_index_patterns
            - set_index_patterns
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
      description: "Edits index patterns of rulesClient.\n\n- `add_index_patterns` adds index patterns to rules. If an index pattern already exists for a rule, no changes are made.\n- `delete_index_patterns` removes index patterns from rules. If an index pattern does not exist for a rule, no changes are made.\n- `set_index_patterns` sets index patterns for rules, overwriting any existing index patterns. If the set of index patterns is the same as the existing index patterns, no changes are made.\n"
    Security_Detections_API_BulkActionEditPayloadInvestigationFields:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - add_investigation_fields
            - delete_investigation_fields
            - set_investigation_fields
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
      description: "Edits investigation fields of rules.\n\n- `add_investigation_fields` adds investigation fields to rules. If an investigation field already exists for a rule, no changes are made.\n- `delete_investigation_fields` removes investigation fields from rules. If an investigation field does not exist for a rule, no changes are made.\n- `set_investigation_fields` sets investigation fields for rules. If the set of investigation fields is the same as the existing investigation fields, no changes are made.\n"
    Security_Detections_API_BulkActionEditPayloadRuleActions:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - add_rule_actions
            - set_rule_actions
          type: string
        value:
          required:
            - actions
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_NormalizedRuleAction'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_ThrottleForBulkActions'
      description: "Edits rule actions of rules.\n\n- `add_rule_actions` adds rule actions to rules. This action is non-idempotent, meaning that even if the same rule action already exists for a rule, it will be added again with a new unique ID.\n- `set_rule_actions` sets rule actions for rules. This action is non-idempotent, meaning that even if the same set of rule actions already exists for a rule, it will be set again and the actions will receive new unique IDs.\n"
    Security_Detections_API_BulkActionEditPayloadSchedule:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - set_schedule
          type: string
        value:
          required:
            - interval
            - lookback
          type: object
          properties:
            interval:
              pattern: '^[1-9]\d*[smh]$'
              type: string
              description: 'Interval in which the rule runs. For example, `"1h"` means the rule runs every hour.'
              example: 1h
            lookback:
              pattern: '^[1-9]\d*[smh]$'
              type: string
              description: "Lookback time for the rules.\n\nAdditional look-back time that the rule analyzes. For example, \"10m\" means the rule analyzes the last 10 minutes of data in addition to the frequency interval.\n"
              example: 1h
      description: "Overwrites schedule of rules. \n\n- `set_schedule` sets a schedule for rules. If the same schedule already exists for a rule, no changes are made.\n\nBoth `interval` and `lookback` have a format of \"{integer}{time_unit}\", where accepted time units are `s` for seconds, `m` for minutes, and `h` for hours. The integer must be positive and larger than 0. Examples: \"45s\", \"30m\", \"6h\"\n"
    Security_Detections_API_BulkActionEditPayloadSetAlertSuppression:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - set_alert_suppression
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
    Security_Detections_API_BulkActionEditPayloadSetAlertSuppressionForThreshold:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - set_alert_suppression_for_threshold
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdAlertSuppression'
    Security_Detections_API_BulkActionEditPayloadTags:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - add_tags
            - delete_tags
            - set_tags
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
      description: "Edits tags of rules.\n\n- `add_tags` adds tags to rules. If a tag already exists for a rule, no changes are made.\n- `delete_tags` removes tags from rules. If a tag does not exist for a rule, no changes are made.\n- `set_tags` sets tags for rules, overwriting any existing tags. If the set of tags is the same as the existing tags, no changes are made.\n"
    Security_Detections_API_BulkActionEditPayloadTimeline:
      required:
        - type
        - value
      type: object
      properties:
        type:
          enum:
            - set_timeline
          type: string
        value:
          required:
            - timeline_id
            - timeline_title
          type: object
          properties:
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
      description: "Edits timeline of rules.\n\n- `set_timeline` sets a timeline for rules. If the same timeline already exists for a rule, no changes are made.\n"
    Security_Detections_API_BulkActionsDryRunErrCode:
      enum:
        - IMMUTABLE
        - PREBUILT_CUSTOMIZATION_LICENSE
        - MACHINE_LEARNING_AUTH
        - MACHINE_LEARNING_INDEX_PATTERN
        - ESQL_INDEX_PATTERN
        - MANUAL_RULE_RUN_FEATURE
        - MANUAL_RULE_RUN_DISABLED_RULE
        - THRESHOLD_RULE_TYPE_IN_SUPPRESSION
        - UNSUPPORTED_RULE_IN_SUPPRESSION_FOR_THRESHOLD
        - RULE_FILL_GAPS_DISABLED_RULE
        - USER_INSUFFICIENT_RULE_PRIVILEGES
      type: string
    Security_Detections_API_BulkActionSkipResult:
      required:
        - id
        - skip_reason
      type: object
      properties:
        id:
          type: string
        name:
          type: string
        skip_reason:
          oneOf:
            - $ref: '#/components/schemas/Security_Detections_API_BulkEditSkipReason'
            - $ref: '#/components/schemas/Security_Detections_API_BulkGapsFillingSkipReason'
    Security_Detections_API_BulkDeleteRules:
      required:
        - action
      type: object
      properties:
        action:
          enum:
            - delete
          type: string
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkDisableRules:
      required:
        - action
      type: object
      properties:
        action:
          enum:
            - disable
          type: string
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkDuplicateRules:
      required:
        - action
      type: object
      properties:
        action:
          enum:
            - duplicate
          type: string
        duplicate:
          required:
            - include_exceptions
            - include_expired_exceptions
          type: object
          properties:
            include_exceptions:
              type: boolean
              description: Whether to copy exceptions from the original rule
            include_expired_exceptions:
              type: boolean
              description: Whether to copy expired exceptions from the original rule
          description: Duplicate object that describes applying an update action.
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkEditActionResponse:
      required:
        - attributes
      type: object
      properties:
        attributes:
          required:
            - results
            - summary
          type: object
          properties:
            errors:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_NormalizedRuleError'
            results:
              $ref: '#/components/schemas/Security_Detections_API_BulkEditActionResults'
            summary:
              $ref: '#/components/schemas/Security_Detections_API_BulkEditActionSummary'
        message:
          type: string
        rules_count:
          type: integer
        status_code:
          type: integer
        success:
          type: boolean
    Security_Detections_API_BulkEditActionResults:
      required:
        - updated
        - created
        - deleted
        - skipped
      type: object
      properties:
        created:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
        deleted:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
        skipped:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_BulkActionSkipResult'
        updated:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleResponse'
    Security_Detections_API_BulkEditActionSummary:
      required:
        - failed
        - skipped
        - succeeded
        - total
      type: object
      properties:
        failed:
          type: integer
        skipped:
          type: integer
        succeeded:
          type: integer
        total:
          type: integer
      description: 'A rule can only be skipped when the bulk action to be performed on it results in nothing being done. For example, if the `edit` action is used to add a tag to a rule that already has that tag, or to delete an index pattern that is not specified in a rule. Objects returned in `attributes.results.skipped` will only include rules'' `id`, `name`, and `skip_reason`.'
    Security_Detections_API_BulkEditRules:
      required:
        - action
        - edit
      type: object
      properties:
        action:
          enum:
            - edit
          type: string
        edit:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_BulkActionEditPayload'
          description: Array of objects containing the edit operations
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkEditSkipReason:
      enum:
        - RULE_NOT_MODIFIED
      type: string
    Security_Detections_API_BulkEnableRules:
      required:
        - action
      type: object
      properties:
        action:
          enum:
            - enable
          type: string
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkExportActionResponse:
      type: string
    Security_Detections_API_BulkExportRules:
      required:
        - action
      type: object
      properties:
        action:
          enum:
            - export
          type: string
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkGapsFillingSkipReason:
      enum:
        - NO_GAPS_TO_FILL
      type: string
    Security_Detections_API_BulkManualRuleFillGaps:
      required:
        - action
        - fill_gaps
      type: object
      properties:
        action:
          enum:
            - fill_gaps
          type: string
        fill_gaps:
          required:
            - start_date
            - end_date
          type: object
          properties:
            end_date:
              type: string
              description: End date of the manual gap fill
            start_date:
              type: string
              description: Start date of the manual gap fill
          description: Object that describes applying a manual gap fill action for the specified time range.
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
    Security_Detections_API_BulkManualRuleRun:
      required:
        - action
        - run
      type: object
      properties:
        action:
          enum:
            - run
          type: string
        gap_auto_fill_scheduler_id:
          type: string
          description: Gap auto fill scheduler ID used to determine gap fill status for rules
        gap_fill_statuses:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_GapFillStatus'
          description: Gap fill statuses to filter rules with gaps by status (used together with gaps_range_*).
        gaps_range_end:
          type: string
          description: 'Gaps range end, valid only when query is provided'
        gaps_range_start:
          type: string
          description: 'Gaps range start, valid only when query is provided'
        ids:
          minItems: 1
          type: array
          items:
            type: string
          description: "Array of rule `id`s to which a bulk action will be applied. Do not use rule's `rule_id` here.\nOnly valid when query property is undefined.\n"
        query:
          type: string
          description: Query to filter rules.
        run:
          required:
            - start_date
            - end_date
          type: object
          properties:
            end_date:
              type: string
              description: End date of the manual rule run
            start_date:
              type: string
              description: Start date of the manual rule run
          description: Object that describes applying a manual rule run action.
    Security_Detections_API_CloseAlertsByIds:
      required:
        - signal_ids
        - status
      type: object
      properties:
        reason:
          $ref: '#/components/schemas/Security_Detections_API_Reason'
        signal_ids:
          minItems: 1
          type: array
          items:
            minLength: 1
            type: string
            format: nonempty
          description: 'List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.'
        status:
          enum:
            - closed
          type: string
    Security_Detections_API_CloseAlertsByQuery:
      required:
        - query
        - status
      type: object
      properties:
        conflicts:
          enum:
            - abort
            - proceed
          type: string
          default: abort
        query:
          type: object
        reason:
          $ref: '#/components/schemas/Security_Detections_API_Reason'
        runtime_fields:
          maxProperties: 100
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
          description: 'Optional map of field name to runtime field type. For each entry, the server defines a runtime field of the given type that reads its value from `_source[fieldName]` and attaches it to the underlying `_update_by_query` as `runtime_mappings`. Allows the `query` to reference non-ECS fields stored on the alert `_source` but not in the alerts index mapping — for example, runtime fields the rule''s source index defined at the time the alerts were created. Limited to 100 entries per request; larger maps are rejected.'
        runtime_mappings:
          maxProperties: 100
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
          description: "Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected."
        status:
          enum:
            - closed
          type: string
    Security_Detections_API_CloseAttacksByIds:
      required:
        - ids
        - status
      type: object
      properties:
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
        reason:
          $ref: '#/components/schemas/Security_Detections_API_Reason'
        status:
          enum:
            - closed
          type: string
        update_related_alerts:
          $ref: '#/components/schemas/Security_Detections_API_UpdateRelatedAlerts'
    Security_Detections_API_ConcurrentSearches:
      minimum: 1
      type: integer
    Security_Detections_API_DataViewId:
      type: string
    Security_Detections_API_DefaultParams:
      required:
        - command
      type: object
      properties:
        command:
          enum:
            - isolate
          type: string
        comment:
          maxLength: 30000
          type: string
    Security_Detections_API_EcsMapping:
      type: object
      additionalProperties:
        type: object
        properties:
          field:
            maxLength: 2000
            type: string
          value:
            oneOf:
              - maxLength: 30000
                type: string
              - type: array
                items:
                  maxLength: 30000
                  type: string
      description: 'Map Osquery results columns or static values to Elastic Common Schema (ECS) fields. Example: "ecs_mapping": {"process.pid": {"field": "pid"}}'
    Security_Detections_API_EndpointResponseAction:
      required:
        - action_type_id
        - params
      type: object
      properties:
        action_type_id:
          enum:
            - .endpoint
          type: string
        params:
          oneOf:
            - $ref: '#/components/schemas/Security_Detections_API_DefaultParams'
            - $ref: '#/components/schemas/Security_Detections_API_ProcessesParams'
            - $ref: '#/components/schemas/Security_Detections_API_RunscriptParams'
    Security_Detections_API_EqlOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        event_category_override:
          $ref: '#/components/schemas/Security_Detections_API_EventCategoryOverride'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        tiebreaker_field:
          $ref: '#/components/schemas/Security_Detections_API_TiebreakerField'
        timestamp_field:
          $ref: '#/components/schemas/Security_Detections_API_TimestampField'
    Security_Detections_API_EqlQueryLanguage:
      enum:
        - eql
      type: string
    Security_Detections_API_EqlRequiredFields:
      required:
        - type
        - query
        - language
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_EqlQueryLanguage'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        type:
          enum:
            - eql
          type: string
          description: Rule type
    Security_Detections_API_EqlRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_EqlRuleResponseFields'
    Security_Detections_API_EqlRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_EqlRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
    Security_Detections_API_EqlRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateFields'
    Security_Detections_API_EqlRulePatchFields:
      allOf:
        - type: object
          properties:
            language:
              $ref: '#/components/schemas/Security_Detections_API_EqlQueryLanguage'
            query:
              $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
            type:
              enum:
                - eql
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
    Security_Detections_API_EqlRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_EqlRulePatchFields'
    Security_Detections_API_EqlRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_EqlRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_EqlOptionalFields'
    Security_Detections_API_EqlRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateFields'
    Security_Detections_API_ErrorSchema:
      required:
        - error
      type: object
      properties:
        error:
          required:
            - status_code
            - message
          type: object
          properties:
            message:
              type: string
            status_code:
              minimum: 400
              type: integer
        id:
          type: string
        item_id:
          minLength: 1
          type: string
        list_id:
          minLength: 1
          type: string
        rule_id:
          $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
      additionalProperties: false
    Security_Detections_API_EsqlQueryLanguage:
      enum:
        - esql
      type: string
    Security_Detections_API_EsqlRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleResponseFields'
    Security_Detections_API_EsqlRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields'
    Security_Detections_API_EsqlRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateFields'
    Security_Detections_API_EsqlRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
    Security_Detections_API_EsqlRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            language:
              $ref: '#/components/schemas/Security_Detections_API_EsqlQueryLanguage'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            query:
              $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            type:
              enum:
                - esql
              type: string
              description: Rule type
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
    Security_Detections_API_EsqlRuleRequiredFields:
      required:
        - type
        - language
        - query
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_EsqlQueryLanguage'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        type:
          enum:
            - esql
          type: string
          description: Rule type
    Security_Detections_API_EsqlRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleRequiredFields'
    Security_Detections_API_EsqlRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateFields'
    Security_Detections_API_EventCategoryOverride:
      type: string
    Security_Detections_API_ExceptionListType:
      enum:
        - detection
        - rule_default
        - endpoint
        - endpoint_trusted_apps
        - endpoint_trusted_devices
        - endpoint_events
        - endpoint_host_isolation_exceptions
        - endpoint_blocklists
        - endpoint_custom_yara_signatures
      type: string
      description: The exception type
    Security_Detections_API_ExternalRuleCustomizedFields:
      type: array
      items:
        required:
          - field_name
        type: object
        properties:
          field_name:
            type: string
            description: Name of a user-modified field in the rule object.
      description: 'An array of customized field names — that is, fields that the user has modified from their base value. Defaults to an empty array.'
    Security_Detections_API_ExternalRuleHasBaseVersion:
      type: boolean
      description: 'Determines whether an external/prebuilt rule has its original, unmodified version present when the calculation of its customization status is performed (`rule_source.is_customized` and `rule_source.customized_fields`).'
    Security_Detections_API_ExternalRuleSource:
      required:
        - type
        - is_customized
        - has_base_version
        - customized_fields
      type: object
      properties:
        customized_fields:
          $ref: '#/components/schemas/Security_Detections_API_ExternalRuleCustomizedFields'
        has_base_version:
          $ref: '#/components/schemas/Security_Detections_API_ExternalRuleHasBaseVersion'
        is_customized:
          $ref: '#/components/schemas/Security_Detections_API_IsExternalRuleCustomized'
        type:
          enum:
            - external
          type: string
      description: 'Type of rule source for externally sourced rules, i.e. rules that have an external source, such as the Elastic Prebuilt rules repo.'
    Security_Detections_API_FindRulesSortField:
      enum:
        - created_at
        - createdAt
        - enabled
        - execution_summary.last_execution.date
        - execution_summary.last_execution.metrics.execution_gap_duration_s
        - execution_summary.last_execution.metrics.total_indexing_duration_ms
        - execution_summary.last_execution.metrics.total_search_duration_ms
        - execution_summary.last_execution.status
        - name
        - risk_score
        - riskScore
        - severity
        - updated_at
        - updatedAt
      type: string
    Security_Detections_API_GapFillStatus:
      enum:
        - unfilled
        - in_progress
        - filled
        - error
      type: string
    Security_Detections_API_HistoryWindowStart:
      minLength: 1
      type: string
      description: 'Start date to use when checking if a term has been seen before. Supports relative dates – for example, now-30d will search the last 30 days of data when checking if a term is new. We do not recommend using absolute dates, which can cause issues with rule performance due to querying increasing amounts of data over time.'
      format: nonempty
    Security_Detections_API_IndexMigrationStatus:
      required:
        - index
        - version
        - signal_versions
        - migrations
        - is_outdated
      type: object
      properties:
        index:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        is_outdated:
          type: boolean
        migrations:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_MigrationStatus'
        signal_versions:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_AlertVersion'
        version:
          type: integer
    Security_Detections_API_IndexPatternArray:
      type: array
      items:
        type: string
      description: "Indices on which the rule functions. Defaults to the Security Solution indices defined on the Kibana Advanced Settings page (Kibana → Stack Management → Advanced Settings → `securitySolution:defaultIndex`).\n> info\n> This field is not supported for ES|QL rules.\n"
    Security_Detections_API_InternalRuleSource:
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - internal
          type: string
      description: 'Type of rule source for internally sourced rules, i.e. created within the Kibana apps.'
    Security_Detections_API_InvestigationFields:
      required:
        - field_names
      type: object
      properties:
        field_names:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
      description: "Schema for fields relating to investigation fields. These are user defined fields we use to highlight\nin various features in the UI such as alert details flyout and exceptions auto-population from alert.\n"
    Security_Detections_API_InvestigationGuide:
      type: string
      description: Notes to help investigate alerts produced by the rule.
    Security_Detections_API_IsExternalRuleCustomized:
      type: boolean
      description: Determines whether an external/prebuilt rule has been customized by the user (i.e. any of its fields have been modified and diverged from the base value).
    Security_Detections_API_IsRuleEnabled:
      type: boolean
      description: Determines whether the rule is enabled. Defaults to true.
    Security_Detections_API_IsRuleImmutable:
      type: boolean
      description: This field determines whether the rule is a prebuilt Elastic rule. It will be replaced with the `rule_source` field.
      deprecated: true
    Security_Detections_API_ItemsPerSearch:
      minimum: 1
      type: integer
    Security_Detections_API_KillProcessParams:
      required:
        - command
        - config
      type: object
      properties:
        command:
          enum:
            - kill-process
          type: string
          description: 'To run an endpoint response action, specify a value for the command field. Example: "command": "kill-process"'
        comment:
          maxLength: 30000
          type: string
          description: 'Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: "comment": "Check processes"'
        config:
          required:
            - field
          type: object
          properties:
            field:
              maxLength: 2000
              type: string
              description: Field to use instead of `process.pid`
            kill_descendants:
              type: boolean
              description: Whether to also terminate the descendant processes of the targeted process.
              x-state: Added in 9.6.0
            overwrite:
              type: boolean
              description: Whether to overwrite field with `process.pid`
              default: true
    Security_Detections_API_KqlQueryLanguage:
      enum:
        - kuery
        - lucene
      type: string
    Security_Detections_API_MachineLearningJobId:
      oneOf:
        - type: string
        - minItems: 1
          type: array
          items:
            type: string
      description: Machine learning job ID(s) the rule monitors for anomaly scores.
    Security_Detections_API_MachineLearningRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleResponseFields'
    Security_Detections_API_MachineLearningRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
    Security_Detections_API_MachineLearningRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields'
    Security_Detections_API_MachineLearningRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
    Security_Detections_API_MachineLearningRulePatchFields:
      allOf:
        - type: object
          properties:
            anomaly_threshold:
              $ref: '#/components/schemas/Security_Detections_API_AnomalyThreshold'
            machine_learning_job_id:
              $ref: '#/components/schemas/Security_Detections_API_MachineLearningJobId'
            type:
              enum:
                - machine_learning
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
    Security_Detections_API_MachineLearningRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRulePatchFields'
    Security_Detections_API_MachineLearningRuleRequiredFields:
      required:
        - type
        - machine_learning_job_id
        - anomaly_threshold
      type: object
      properties:
        anomaly_threshold:
          $ref: '#/components/schemas/Security_Detections_API_AnomalyThreshold'
        machine_learning_job_id:
          $ref: '#/components/schemas/Security_Detections_API_MachineLearningJobId'
        type:
          enum:
            - machine_learning
          type: string
          description: Rule type
    Security_Detections_API_MachineLearningRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleOptionalFields'
    Security_Detections_API_MachineLearningRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateFields'
    Security_Detections_API_MaxSignals:
      minimum: 1
      type: integer
      description: "Maximum number of alerts the rule can create during a single run (the rule’s Max alerts per run [advanced setting](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#rule-ui-advanced-params) value). Defaults to `100`.\n> info\n> This setting can be superseded by the [Kibana configuration setting](https://www.elastic.co/docs/reference/kibana/configuration-reference/alerting-settings) `xpack.alerting.rules.run.alerts.max`, which determines the maximum alerts generated by any rule in the Kibana alerting framework. For example, if `xpack.alerting.rules.run.alerts.max` is set to 1000, the rule can generate no more than 1000 alerts even if `max_signals` is set higher.\n"
    Security_Detections_API_MigrationCleanupResult:
      required:
        - id
        - destinationIndex
        - status
        - sourceIndex
        - version
        - updated
      type: object
      properties:
        destinationIndex:
          type: string
        error:
          required:
            - message
            - status_code
          type: object
          properties:
            message:
              type: string
            status_code:
              type: integer
        id:
          type: string
        sourceIndex:
          type: string
        status:
          enum:
            - success
            - failure
            - pending
          type: string
        updated:
          type: string
          format: date-time
        version:
          type: string
    Security_Detections_API_MigrationFinalizationResult:
      required:
        - id
        - completed
        - destinationIndex
        - status
        - sourceIndex
        - version
        - updated
      type: object
      properties:
        completed:
          type: boolean
        destinationIndex:
          type: string
        error:
          required:
            - message
            - status_code
          type: object
          properties:
            message:
              type: string
            status_code:
              type: integer
        id:
          type: string
        sourceIndex:
          type: string
        status:
          enum:
            - success
            - failure
            - pending
          type: string
        updated:
          type: string
          format: date-time
        version:
          type: string
    Security_Detections_API_MigrationStatus:
      required:
        - id
        - status
        - version
        - updated
      type: object
      properties:
        id:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        status:
          enum:
            - success
            - failure
            - pending
          type: string
        updated:
          type: string
          format: date-time
        version:
          type: integer
    Security_Detections_API_NewTermsFields:
      maxItems: 3
      minItems: 1
      type: array
      items:
        type: string
      description: Fields to monitor for new values.
    Security_Detections_API_NewTermsRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleResponseFields'
    Security_Detections_API_NewTermsRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields'
    Security_Detections_API_NewTermsRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields'
    Security_Detections_API_NewTermsRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_NewTermsRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
    Security_Detections_API_NewTermsRulePatchFields:
      allOf:
        - type: object
          properties:
            history_window_start:
              $ref: '#/components/schemas/Security_Detections_API_HistoryWindowStart'
            new_terms_fields:
              $ref: '#/components/schemas/Security_Detections_API_NewTermsFields'
            query:
              $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
            type:
              enum:
                - new_terms
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleDefaultableFields'
    Security_Detections_API_NewTermsRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRulePatchFields'
    Security_Detections_API_NewTermsRuleRequiredFields:
      required:
        - type
        - query
        - new_terms_fields
        - history_window_start
      type: object
      properties:
        history_window_start:
          $ref: '#/components/schemas/Security_Detections_API_HistoryWindowStart'
        new_terms_fields:
          $ref: '#/components/schemas/Security_Detections_API_NewTermsFields'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        type:
          enum:
            - new_terms
          type: string
          description: Rule type
    Security_Detections_API_NewTermsRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleOptionalFields'
        - required:
            - language
          type: object
          properties:
            language:
              $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_NewTermsRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateFields'
    Security_Detections_API_NonEmptyString:
      minLength: 1
      type: string
      description: A string that does not contain only whitespace characters
      format: nonempty
    Security_Detections_API_NormalizedRuleAction:
      required:
        - id
        - params
      type: object
      properties:
        alerts_filter:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionAlertsFilter'
        frequency:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionFrequency'
        group:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionGroup'
        id:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionId'
        params:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionParams'
      additionalProperties: false
    Security_Detections_API_NormalizedRuleError:
      required:
        - message
        - status_code
        - rules
      type: object
      properties:
        err_code:
          $ref: '#/components/schemas/Security_Detections_API_BulkActionsDryRunErrCode'
        message:
          type: string
        rules:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_RuleDetailsInError'
        status_code:
          type: integer
    Security_Detections_API_OsqueryParams:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Detections_API_EcsMapping'
        pack_id:
          maxLength: 256
          type: string
          description: 'To specify a query pack, use the packId field. Example: "packId": "processes_elastic"'
        queries:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_OsqueryQuery'
        query:
          maxLength: 30000
          type: string
          description: 'To run a single query, use the query field and enter a SQL query. Example: "query": "SELECT * FROM processes;"'
        saved_query_id:
          maxLength: 256
          type: string
          description: 'To run a saved query, use the saved_query_id field and specify the saved query ID. Example: "saved_query_id": "processes_elastic"'
        timeout:
          type: number
          description: 'A timeout period, in seconds, after which the query will stop running. Overwriting the default timeout allows you to support queries that require more time to complete. The default and minimum supported value is 60. The maximum supported value is 900. Example: "timeout": 120.'
    Security_Detections_API_OsqueryQuery:
      required:
        - id
        - query
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Detections_API_EcsMapping'
        id:
          maxLength: 256
          type: string
          description: Query ID
        platform:
          maxLength: 256
          type: string
        query:
          maxLength: 30000
          type: string
          description: Query to run
        removed:
          type: boolean
        snapshot:
          type: boolean
        version:
          maxLength: 256
          type: string
          description: Query version
    Security_Detections_API_OsqueryResponseAction:
      required:
        - action_type_id
        - params
      type: object
      properties:
        action_type_id:
          enum:
            - .osquery
          type: string
        params:
          $ref: '#/components/schemas/Security_Detections_API_OsqueryParams'
    Security_Detections_API_PlatformErrorResponse:
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
    Security_Detections_API_ProcessesParams:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_KillProcessParams'
        - $ref: '#/components/schemas/Security_Detections_API_SuspendProcessParams'
      discriminator:
        propertyName: command
        mapping:
          kill-process: '#/components/schemas/Security_Detections_API_KillProcessParams'
          suspend-process: '#/components/schemas/Security_Detections_API_SuspendProcessParams'
    Security_Detections_API_QueryAlertsBodyParams:
      type: object
      properties:
        _source:
          oneOf:
            - type: boolean
            - type: string
            - type: array
              items:
                type: string
        aggs:
          type: object
        fields:
          type: array
          items:
            type: string
        query:
          type: object
        runtime_mappings:
          type: object
        size:
          minimum: 0
          type: integer
        sort:
          $ref: '#/components/schemas/Security_Detections_API_AlertsSort'
        track_total_hits:
          type: boolean
    Security_Detections_API_QueryRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleResponseFields'
    Security_Detections_API_QueryRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields'
    Security_Detections_API_QueryRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateFields'
    Security_Detections_API_QueryRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
    Security_Detections_API_QueryRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
    Security_Detections_API_QueryRulePatchFields:
      allOf:
        - type: object
          properties:
            type:
              enum:
                - query
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleDefaultableFields'
    Security_Detections_API_QueryRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRulePatchFields'
    Security_Detections_API_QueryRuleRequiredFields:
      required:
        - type
      type: object
      properties:
        type:
          enum:
            - query
          type: string
          description: Rule type
    Security_Detections_API_QueryRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleOptionalFields'
        - required:
            - query
            - language
          type: object
          properties:
            language:
              $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
            query:
              $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
    Security_Detections_API_QueryRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateFields'
    Security_Detections_API_Reason:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_ReasonEnum'
        - maxLength: 1024
          minLength: 1
          type: string
      description: 'The reason for closing the alerts. Can be one of following predefined reasons: [false_positive, duplicate, true_positive, benign_positive, automated_closure, other] or a custom reason provided by the user through the advanced settings.'
    Security_Detections_API_ReasonEnum:
      enum:
        - false_positive
        - duplicate
        - true_positive
        - benign_positive
        - automated_closure
        - other
      type: string
    Security_Detections_API_RelatedIntegration:
      required:
        - package
        - version
      type: object
      properties:
        integration:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        package:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        version:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
      description: "Related integration is a potential dependency of a rule. It's assumed that if the user installs\none of the related integrations of a rule, the rule might start to work properly because it will\nhave source events (generated by this integration) potentially matching the rule's query.\n\nNOTE: Proper work is not guaranteed, because a related integration, if installed, can be\nconfigured differently or generate data that is not necessarily relevant for this rule.\n\nRelated integration is a combination of a Fleet package and (optionally) one of the\npackage's \"integrations\" that this package contains. It is represented by 3 properties:\n\n- `package`: name of the package (required, unique id)\n- `version`: version of the package (required, semver-compatible)\n- `integration`: name of the integration of this package (optional, id within the package)\n\nThere are Fleet packages like `windows` that contain only one integration; in this case,\n`integration` should be unspecified. There are also packages like `aws` and `azure` that contain\nseveral integrations; in this case, `integration` should be specified.\n"
      example:
        integration: activitylogs
        package: azure
        version: ~1.1.6
    Security_Detections_API_RelatedIntegrationArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Detections_API_RelatedIntegration'
    Security_Detections_API_RequiredField:
      required:
        - name
        - type
        - ecs
      type: object
      properties:
        ecs:
          type: boolean
          description: Indicates whether the field is ECS-compliant. This property is only present in responses. Its value is computed based on field’s name and type.
        name:
          minLength: 1
          type: string
          description: Name of an Elasticsearch field
          format: nonempty
        type:
          minLength: 1
          type: string
          description: Type of the Elasticsearch field
          format: nonempty
      description: "Describes an Elasticsearch field that is needed for the rule to function.\n\nAlmost all types of Security rules check source event documents for a match to some kind of\nquery or filter. If a document has certain field with certain values, then it's a match and\nthe rule will generate an alert.\n\nRequired field is an event field that must be present in the source indices of a given rule.\n\n@example\nconst standardEcsField: RequiredField = {\n  name: 'event.action',\n  type: 'keyword',\n  ecs: true,\n};\n\n@example\nconst nonEcsField: RequiredField = {\n  name: 'winlog.event_data.AttributeLDAPDisplayName',\n  type: 'keyword',\n  ecs: false,\n};\n"
    Security_Detections_API_RequiredFieldArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Detections_API_RequiredField'
    Security_Detections_API_RequiredFieldInput:
      required:
        - name
        - type
      type: object
      properties:
        name:
          minLength: 1
          type: string
          description: Name of an Elasticsearch field
          format: nonempty
        type:
          minLength: 1
          type: string
          description: Type of the Elasticsearch field
          format: nonempty
      description: 'Input parameters to create a RequiredField. Does not include the `ecs` field, because `ecs` is calculated on the backend based on the field name and type.'
    Security_Detections_API_ResponseAction:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_OsqueryResponseAction'
        - $ref: '#/components/schemas/Security_Detections_API_EndpointResponseAction'
      discriminator:
        propertyName: action_type_id
        mapping:
          .endpoint: '#/components/schemas/Security_Detections_API_EndpointResponseAction'
          .osquery: '#/components/schemas/Security_Detections_API_OsqueryResponseAction'
    Security_Detections_API_ResponseFields:
      required:
        - id
        - rule_id
        - immutable
        - rule_source
        - updated_at
        - updated_by
        - created_at
        - created_by
        - revision
        - related_integrations
        - required_fields
      type: object
      properties:
        created_at:
          type: string
          format: date-time
        created_by:
          type: string
        execution_summary:
          $ref: '#/components/schemas/Security_Detections_API_RuleExecutionSummary'
        id:
          $ref: '#/components/schemas/Security_Detections_API_UUID'
        immutable:
          $ref: '#/components/schemas/Security_Detections_API_IsRuleImmutable'
        required_fields:
          $ref: '#/components/schemas/Security_Detections_API_RequiredFieldArray'
        revision:
          $ref: '#/components/schemas/Security_Detections_API_RuleRevision'
        rule_id:
          $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
        rule_source:
          $ref: '#/components/schemas/Security_Detections_API_RuleSource'
        updated_at:
          type: string
          format: date-time
        updated_by:
          type: string
    Security_Detections_API_RiskScore:
      maximum: 100
      minimum: 0
      type: integer
      description: "A numerical representation of the alert's severity from 0 to 100, where:\n* `0` - `21` represents low severity\n* `22` - `47` represents medium severity\n* `48` - `73` represents high severity\n* `74` - `100` represents critical severity\n"
    Security_Detections_API_RiskScoreMapping:
      type: array
      items:
        required:
          - field
          - operator
          - value
        type: object
        properties:
          field:
            type: string
            description: Source event field used to override the default `risk_score`.
          operator:
            enum:
              - equals
            type: string
          risk_score:
            $ref: '#/components/schemas/Security_Detections_API_RiskScore'
          value:
            type: string
      description: Overrides generated alerts' risk_score with a value from the source event
    Security_Detections_API_RuleAction:
      required:
        - action_type_id
        - id
        - params
      type: object
      properties:
        action_type_id:
          type: string
          description: "The action type used for sending notifications, can be:\n\n  - `.slack`\n  - `.slack_api`\n  - `.email`\n  - `.index`\n  - `.pagerduty`\n  - `.swimlane`\n  - `.webhook`\n  - `.servicenow`\n  - `.servicenow-itom`\n  - `.servicenow-sir`\n  - `.jira`\n  - `.resilient`\n  - `.opsgenie`\n  - `.teams`\n  - `.torq`\n  - `.tines`\n  - `.d3security`\n"
        alerts_filter:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionAlertsFilter'
        frequency:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionFrequency'
        group:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionGroup'
        id:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionId'
        params:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionParams'
        uuid:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
    Security_Detections_API_RuleActionAlertsFilter:
      type: object
      description: "Object containing an action’s conditional filters.\n\n- `timeframe` (object, optional): Object containing the time frame for when this action can be run.\n    - `days` (array of integers, required): List of days of the week on which this action will be run. Days of the week are expressed as numbers between `1-7`, where `1` is Monday and `7` is Sunday. To select all days of the week, enter an empty array.\n    - `hours` (object, required): The hours of the day during which this action will run. Hours of the day are expressed as two strings in the format `hh:mm` in `24` hour time. A start of `00:00` and an end of `24:00` means the action can run all day.\n        - start (string, required): Start time in `hh:mm` format.\n        - end (string, required): End time in `hh:mm` format.\n    - `timezone` (string, required): An ISO timezone name, such as `Europe/Madrid` or `America/New_York`. Specific offsets such as `UTC` or `UTC+1` will also work, but lack built-in DST.\n- `query` (object, optional): Object containing a query filter which gets applied to an action and determines whether the action should run.\n    - `kql` (string, required): A KQL string.\n    - `filters` (array of objects, required): Array of filter objects, as defined in the `kbn-es-query` package.\n"
    Security_Detections_API_RuleActionFrequency:
      required:
        - summary
        - notifyWhen
        - throttle
      type: object
      properties:
        notifyWhen:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionNotifyWhen'
        summary:
          type: boolean
          description: Action summary indicates whether we will send a summary notification about all the generate alerts or notification per individual alert
        throttle:
          $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
      description: 'The action frequency defines when the action runs (for example, only on rule execution or at specific time intervals).'
    Security_Detections_API_RuleActionGroup:
      type: string
      description: Optionally groups actions by use cases. Use `default` for alert notifications.
    Security_Detections_API_RuleActionId:
      type: string
      description: The connector ID.
    Security_Detections_API_RuleActionNotifyWhen:
      enum:
        - onActiveAlert
        - onThrottleInterval
        - onActionGroupChange
      type: string
      description: Defines how often rules run actions.
    Security_Detections_API_RuleActionParams:
      type: object
      description: "Object containing the allowed connector fields, which varies according to the connector type.\n\nFor Slack:\n\n  - `message` (string, required): The notification message.\n\nFor email:\n\n  - `to`, `cc`, `bcc` (string): Email addresses to which the notifications are sent. At least one field must have a value.\n  - `subject` (string, optional): Email subject line.\n  - `message` (string, required): Email body text.\n\nFor Webhook:\n\n  - `body` (string, required): JSON payload.\n\nFor PagerDuty:\n\n  - `severity` (string, required): Severity of on the alert notification, can be: `Critical`, `Error`, `Warning` or `Info`.\n  - `eventAction` (string, required): Event [action type](https://v2.developer.pagerduty.com/docs/events-api-v2#event-action), which can be `trigger`, `resolve`, or `acknowledge`.\n  - `dedupKey` (string, optional): Groups alert notifications with the same PagerDuty alert.\n  - `timestamp` (DateTime, optional): ISO-8601 format [timestamp](https://v2.developer.pagerduty.com/docs/types#datetime).\n  - `component` (string, optional): Source machine component responsible for the event, for example `security-solution`.\n  - `group` (string, optional): Enables logical grouping of service components.\n  - `source` (string, optional): The affected system. Defaults to the Kibana saved object ID of the action.\n  - `summary` (string, options): Summary of the event. Defaults to `No summary provided`. Maximum length is 1024 characters.\n  - `class` (string, optional): Value indicating the class/type of the event.\n"
    Security_Detections_API_RuleActionThrottle:
      oneOf:
        - enum:
            - no_actions
            - rule
          type: string
        - pattern: '^[1-9]\d*[smhd]$'
          type: string
          description: 'Time interval in seconds, minutes, hours, or days.'
          example: 1h
      description: Defines how often rule actions are taken.
    Security_Detections_API_RuleAuthorArray:
      type: array
      items:
        type: string
      description: The rule’s author.
    Security_Detections_API_RuleCreateProps:
      anyOf:
        - $ref: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
      discriminator:
        propertyName: type
        mapping:
          eql: '#/components/schemas/Security_Detections_API_EqlRuleCreateProps'
          esql: '#/components/schemas/Security_Detections_API_EsqlRuleCreateProps'
          machine_learning: '#/components/schemas/Security_Detections_API_MachineLearningRuleCreateProps'
          new_terms: '#/components/schemas/Security_Detections_API_NewTermsRuleCreateProps'
          query: '#/components/schemas/Security_Detections_API_QueryRuleCreateProps'
          saved_query: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateProps'
          threat_match: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateProps'
          threshold: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateProps'
    Security_Detections_API_RuleDescription:
      minLength: 1
      type: string
      description: The rule’s description.
      example: Detects anomalous Windows process creation events.
    Security_Detections_API_RuleDetailsInError:
      required:
        - id
      type: object
      properties:
        id:
          type: string
        name:
          type: string
    Security_Detections_API_RuleExceptionList:
      required:
        - id
        - list_id
        - type
        - namespace_type
      type: object
      properties:
        id:
          minLength: 1
          type: string
          description: ID of the exception container
          format: nonempty
        list_id:
          minLength: 1
          type: string
          description: List ID of the exception container
          format: nonempty
        namespace_type:
          enum:
            - agnostic
            - single
          type: string
          description: Determines the exceptions validity in rule's Kibana space
        type:
          $ref: '#/components/schemas/Security_Detections_API_ExceptionListType'
      description: "Array of [exception containers](https://www.elastic.co/docs/solutions/security/detect-and-alert/detection-rule-concepts), which define exceptions that prevent the rule from generating alerts even when its other criteria are met.\n"
    Security_Detections_API_RuleExecutionMetrics:
      type: object
      properties:
        execution_gap_duration_s:
          minimum: 0
          type: integer
          description: Duration in seconds of execution gap
        frozen_indices_queried_count:
          minimum: 0
          type: integer
          description: Count of frozen indices queried during the rule execution. These indices could not be entirely excluded after applying the time range filter.
        gap_range:
          required:
            - gte
            - lte
          type: object
          properties:
            gte:
              type: string
              description: Start date of the execution gap
            lte:
              type: string
              description: End date of the execution gap
          description: Range of the execution gap
        gap_reason:
          required:
            - type
          type: object
          properties:
            type:
              enum:
                - rule_disabled
                - rule_did_not_run
              type: string
              description: The type of reason for the gap (rule_disabled or rule_did_not_run)
          description: Detected reason for the execution gap
        total_enrichment_duration_ms:
          minimum: 0
          type: integer
          description: Total time spent enriching documents during current rule execution cycle
        total_indexing_duration_ms:
          minimum: 0
          type: integer
          description: Total time spent indexing documents during current rule execution cycle
        total_search_duration_ms:
          minimum: 0
          type: integer
          description: Total time spent performing ES searches as measured by Kibana; includes network latency and time spent serializing/deserializing request/response
    Security_Detections_API_RuleExecutionStatus:
      enum:
        - going to run
        - running
        - partial failure
        - failed
        - succeeded
      type: string
      description: "Custom execution status of Security rules that is different from the status used in the Alerting Framework. We merge our custom status with the Framework's status to determine the resulting status of a rule.\n- going to run - @deprecated Replaced by the 'running' status but left for backwards compatibility with rule execution events already written to Event Log in the prior versions of Kibana. Don't use when writing rule status changes.\n- running - Rule execution started but not reached any intermediate or final status.\n- partial failure - Rule can partially fail for various reasons either in the middle of an execution (in this case we update its status right away) or in the end of it. So currently this status can be both intermediate and final at the same time. A typical reason for a partial failure: not all the indices that the rule searches over actually exist.\n- failed - Rule failed to execute due to unhandled exception or a reason defined in the business logic of its executor function.\n- succeeded - Rule executed successfully without any issues. Note: this status is just an indication of a rule's \"health\". The rule might or might not generate any alerts despite of it."
    Security_Detections_API_RuleExecutionStatusOrder:
      type: integer
    Security_Detections_API_RuleExecutionSummary:
      required:
        - last_execution
      type: object
      properties:
        last_execution:
          required:
            - date
            - status
            - status_order
            - message
            - metrics
          type: object
          properties:
            date:
              type: string
              description: Date of the last execution
              format: date-time
            message:
              type: string
            metrics:
              $ref: '#/components/schemas/Security_Detections_API_RuleExecutionMetrics'
            status:
              $ref: '#/components/schemas/Security_Detections_API_RuleExecutionStatus'
            status_order:
              $ref: '#/components/schemas/Security_Detections_API_RuleExecutionStatusOrder'
      description: "Summary of the last execution of a rule.\n> info\n> This field is under development and its usage or schema may change\n"
    Security_Detections_API_RuleFalsePositiveArray:
      type: array
      items:
        type: string
      description: String array used to describe common reasons why the rule may issue false-positive alerts. Defaults to an empty array.
    Security_Detections_API_RuleFilterArray:
      type: array
      items: { }
      description: "The query and filter context array used to define the conditions for when alerts are created from events. Defaults to an empty array.\n> info\n> This field is not supported for ES|QL rules.\n"
    Security_Detections_API_RuleInterval:
      type: string
      description: 'Frequency of rule execution, using a date math range. For example, "1h" means the rule runs every hour. Defaults to 5m (5 minutes).'
    Security_Detections_API_RuleIntervalFrom:
      type: string
      description: 'Time from which data is analyzed each time the rule runs, using a date math range. For example, now-4200s means the rule analyzes data from 70 minutes before its start time. Defaults to now-6m (analyzes data from 6 minutes before the start time).'
      format: date-math
    Security_Detections_API_RuleIntervalTo:
      type: string
    Security_Detections_API_RuleLicense:
      type: string
      description: The rule's license.
    Security_Detections_API_RuleMetadata:
      type: object
      description: "Placeholder for metadata about the rule.\n> info\n> This field is overwritten when you save changes to the rule’s settings.\n"
    Security_Detections_API_RuleName:
      minLength: 1
      type: string
      description: A human-readable name for the rule.
      example: Anomalous Windows Process Creation
    Security_Detections_API_RuleNameOverride:
      type: string
      description: 'Sets which field in the source event is used to populate the alert''s `signal.rule.name` value (in the UI, this value is displayed on the Rules page in the Rule column). When unspecified, the rule’s `name` value is used. The source field must be a string data type.'
    Security_Detections_API_RuleObjectId:
      $ref: '#/components/schemas/Security_Detections_API_UUID'
    Security_Detections_API_RulePatchProps:
      anyOf:
        - $ref: '#/components/schemas/Security_Detections_API_EqlRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRulePatchProps'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRulePatchProps'
    Security_Detections_API_RulePreviewLoggedRequest:
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        duration:
          type: integer
        request:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        request_type:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
    Security_Detections_API_RulePreviewLogs:
      required:
        - errors
        - warnings
        - duration
      type: object
      properties:
        duration:
          type: integer
          description: Execution duration in milliseconds
        errors:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        requests:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_RulePreviewLoggedRequest'
        startedAt:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        warnings:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
    Security_Detections_API_RulePreviewParams:
      required:
        - invocationCount
        - timeframeEnd
      type: object
      properties:
        invocationCount:
          type: integer
        timeframeEnd:
          type: string
          format: date-time
    Security_Detections_API_RuleQuery:
      type: string
      description: "[Query](https://www.elastic.co/docs/explore-analyze/query-filter) used by the rule to create alerts.\n\n- For indicator match rules, only the query’s results are used to determine whether an alert is generated.\n- ES|QL rules have additional query requirements. Refer to [Create ES|QL](https://www.elastic.co/docs/solutions/security/detect-and-alert/create-detection-rule#create-esql-rule) rules for more information.\n"
    Security_Detections_API_RuleReferenceArray:
      type: array
      items:
        type: string
      description: Array containing notes about or references to relevant information about the rule. Defaults to an empty array.
    Security_Detections_API_RuleResponse:
      anyOf:
        - $ref: '#/components/schemas/Security_Detections_API_EqlRule'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRule'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRule'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRule'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRule'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRule'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRule'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRule'
      discriminator:
        propertyName: type
        mapping:
          eql: '#/components/schemas/Security_Detections_API_EqlRule'
          esql: '#/components/schemas/Security_Detections_API_EsqlRule'
          machine_learning: '#/components/schemas/Security_Detections_API_MachineLearningRule'
          new_terms: '#/components/schemas/Security_Detections_API_NewTermsRule'
          query: '#/components/schemas/Security_Detections_API_QueryRule'
          saved_query: '#/components/schemas/Security_Detections_API_SavedQueryRule'
          threat_match: '#/components/schemas/Security_Detections_API_ThreatMatchRule'
          threshold: '#/components/schemas/Security_Detections_API_ThresholdRule'
    Security_Detections_API_RuleRevision:
      minimum: 0
      type: integer
      description: "The rule's revision number.\n\nIt represents the version of rule's object in Kibana. It is set to `0` when the rule is installed or created and then gets incremented on each update.\n> info\n> Not all updates to any rule fields will increment the revision. Only those fields that are considered static `rule parameters` can trigger revision increments. For example, an update to a rule's query or index fields will increment the rule's revision by `1`. However, changes to dynamic or technical fields like enabled or execution_summary will not cause revision increments.\n"
    Security_Detections_API_RuleSignatureId:
      type: string
      description: 'A stable unique identifier for the rule object. It can be assigned during rule creation. It can be any string, but often is a UUID. It should be unique not only within a given Kibana space, but also across spaces and Elastic environments. The same prebuilt Elastic rule, when installed in two different Kibana spaces or two different Elastic environments, will have the same `rule_id`s.'
    Security_Detections_API_RuleSource:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_ExternalRuleSource'
        - $ref: '#/components/schemas/Security_Detections_API_InternalRuleSource'
      description: 'Discriminated union that determines whether the rule is internally sourced (created within the Kibana app) or has an external source, such as the Elastic Prebuilt rules repo.'
      discriminator:
        propertyName: type
    Security_Detections_API_RuleTagArray:
      type: array
      items:
        type: string
      description: 'String array containing words and phrases to help categorize, filter, and search rules. Defaults to an empty array.'
    Security_Detections_API_RuleUpdateProps:
      anyOf:
        - $ref: '#/components/schemas/Security_Detections_API_EqlRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_QueryRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps'
        - $ref: '#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps'
      discriminator:
        propertyName: type
        mapping:
          eql: '#/components/schemas/Security_Detections_API_EqlRuleUpdateProps'
          esql: '#/components/schemas/Security_Detections_API_EsqlRuleUpdateProps'
          machine_learning: '#/components/schemas/Security_Detections_API_MachineLearningRuleUpdateProps'
          new_terms: '#/components/schemas/Security_Detections_API_NewTermsRuleUpdateProps'
          query: '#/components/schemas/Security_Detections_API_QueryRuleUpdateProps'
          saved_query: '#/components/schemas/Security_Detections_API_SavedQueryRuleUpdateProps'
          threat_match: '#/components/schemas/Security_Detections_API_ThreatMatchRuleUpdateProps'
          threshold: '#/components/schemas/Security_Detections_API_ThresholdRuleUpdateProps'
    Security_Detections_API_RuleVersion:
      minimum: 1
      type: integer
      description: "The rule's version number.\n\n- For prebuilt rules it represents the version of the rule's content in the source [detection-rules](https://github.com/elastic/detection-rules) repository (and the corresponding `security_detection_engine` Fleet package that is used for distributing prebuilt rules). \n- For custom rules it is set to `1` when the rule is created. \n> info\n> It is not incremented on each update. Compare this to the `revision` field.\n"
    Security_Detections_API_RunScriptOsConfigValues:
      minProperties: 1
      type: object
      properties:
        scriptId:
          maxLength: 256
          type: string
          description: The ID of the script to run (from the Kibana Script library)
        scriptInput:
          maxLength: 8192
          type: string
          description: The arguments to pass to the script (if any)
        timeout:
          type: integer
          description: Specify the timeout in seconds for the script execution
          example: 60
    Security_Detections_API_RunscriptParams:
      required:
        - command
      type: object
      properties:
        command:
          enum:
            - runscript
          type: string
        comment:
          maxLength: 30000
          type: string
          description: Add a note that explains or describes the action. You can find your comment in the response actions history log
        config:
          type: object
          properties:
            linux:
              $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
            macos:
              $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
            windows:
              $ref: '#/components/schemas/Security_Detections_API_RunScriptOsConfigValues'
      description: Run a script on the Elastic Defend host that triggered the alert.
    Security_Detections_API_RuntimeFieldMapping:
      required:
        - type
      type: object
      properties:
        format:
          maxLength: 100
          type: string
          description: 'Format string for date runtime fields, for example `strict_date_optional_time`.'
        script:
          required:
            - source
          type: object
          properties:
            source:
              maxLength: 10000
              type: string
              description: Painless script source to execute.
          additionalProperties: false
          description: 'Inline Painless script that Elasticsearch evaluates for each alert. Only `source` is accepted. Stored scripts, parameterized scripts (`params`), and non-default `lang` values are not supported. Extra properties are rejected with a 400 so the script is not run with different semantics.'
        type:
          $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
      description: 'A runtime field included in the status-update query so the query can match fields that are not in the alerts index mapping, for example scripted fields on a data view. Elasticsearch evaluates the field at query time.'
    Security_Detections_API_RuntimeFieldType:
      enum:
        - keyword
        - long
        - double
        - date
        - ip
        - boolean
        - geo_point
      type: string
      description: The data type for the runtime field type. Determines how the field value is indexed and queried.
    Security_Detections_API_SavedObjectResolveAliasPurpose:
      enum:
        - savedObjectConversion
        - savedObjectImport
      type: string
    Security_Detections_API_SavedObjectResolveAliasTargetId:
      type: string
    Security_Detections_API_SavedObjectResolveOutcome:
      enum:
        - exactMatch
        - aliasMatch
        - conflict
      type: string
    Security_Detections_API_SavedQueryId:
      type: string
      description: 'Kibana [saved search](https://www.elastic.co/docs/explore-analyze/discover/search-sessions) used by the rule to create alerts.'
    Security_Detections_API_SavedQueryRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleResponseFields'
    Security_Detections_API_SavedQueryRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields'
    Security_Detections_API_SavedQueryRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields'
    Security_Detections_API_SavedQueryRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_SavedQueryRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
    Security_Detections_API_SavedQueryRulePatchFields:
      allOf:
        - type: object
          properties:
            saved_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
            type:
              enum:
                - saved_query
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleDefaultableFields'
    Security_Detections_API_SavedQueryRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRulePatchFields'
    Security_Detections_API_SavedQueryRuleRequiredFields:
      required:
        - type
        - saved_id
      type: object
      properties:
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
        type:
          enum:
            - saved_query
          type: string
          description: Rule type
    Security_Detections_API_SavedQueryRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleOptionalFields'
        - required:
            - language
          type: object
          properties:
            language:
              $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_SavedQueryRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_SavedQueryRuleCreateFields'
    Security_Detections_API_SetAlertAssigneesBody:
      required:
        - assignees
        - ids
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Security_Detections_API_AlertAssignees'
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
    Security_Detections_API_SetAlertsStatusByIds:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_CloseAlertsByIds'
        - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByIdsBase'
      discriminator:
        propertyName: status
        mapping:
          closed: '#/components/schemas/Security_Detections_API_CloseAlertsByIds'
    Security_Detections_API_SetAlertsStatusByIdsBase:
      required:
        - signal_ids
        - status
      type: object
      properties:
        signal_ids:
          minItems: 1
          type: array
          items:
            minLength: 1
            type: string
            format: nonempty
          description: 'List of alert ids. Use field `_id` on alert document or `kibana.alert.uuid`. Note: signals are a deprecated term for alerts.'
        status:
          $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
    Security_Detections_API_SetAlertsStatusByQuery:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_CloseAlertsByQuery'
        - $ref: '#/components/schemas/Security_Detections_API_SetAlertsStatusByQueryBase'
      discriminator:
        propertyName: status
        mapping:
          closed: '#/components/schemas/Security_Detections_API_CloseAlertsByQuery'
    Security_Detections_API_SetAlertsStatusByQueryBase:
      required:
        - query
        - status
      type: object
      properties:
        conflicts:
          enum:
            - abort
            - proceed
          type: string
          default: abort
        query:
          type: object
        runtime_fields:
          maxProperties: 100
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldType'
          description: 'Optional map of field name to runtime field type. For each entry, a runtime field of the specified type is created reading its value from `_source[fieldName]` and included in the query as `runtime_mappings`. Use this to reference fields stored on the alert `_source` that are not part of the Elastic Common Schema (ECS) of the alerts index mapping, for example, custom fields that the rule''s source index defined when the alerts were created.'
        runtime_mappings:
          maxProperties: 100
          type: object
          additionalProperties:
            $ref: '#/components/schemas/Security_Detections_API_RuntimeFieldMapping'
          description: "Use this when the query references fields that are not in the alerts index mapping, for example data view runtime fields with a Painless script.\nKibana sends `type`, `script.source`, and `format` to Elasticsearch as `runtime_mappings` on the status-update query. Unlike `runtime_fields`, Kibana keeps your script and runs it at query time. It does not replace the script with a `_source` reader.\nWhen a script is present, Kibana sets `on_script_error` to `continue`. If the script fails on one alert, that field has no value for the alert and the update continues.\nUnique field names across `runtime_fields` and `runtime_mappings` combined cannot exceed 100. Larger maps are rejected."
        status:
          $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
    Security_Detections_API_SetAlertTags:
      required:
        - tags_to_add
        - tags_to_remove
      type: object
      properties:
        tags_to_add:
          $ref: '#/components/schemas/Security_Detections_API_AlertTags'
        tags_to_remove:
          $ref: '#/components/schemas/Security_Detections_API_AlertTags'
      description: Object with list of tags to add and remove.
    Security_Detections_API_SetAlertTagsBody:
      required:
        - ids
        - tags
      type: object
      properties:
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
        tags:
          $ref: '#/components/schemas/Security_Detections_API_SetAlertTags'
    Security_Detections_API_SetAttacksAssigneesByIds:
      required:
        - ids
        - assignees
      type: object
      properties:
        assignees:
          $ref: '#/components/schemas/Security_Detections_API_AlertAssignees'
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
        update_related_alerts:
          $ref: '#/components/schemas/Security_Detections_API_UpdateRelatedAlerts'
    Security_Detections_API_SetAttacksStatusByIds:
      oneOf:
        - $ref: '#/components/schemas/Security_Detections_API_CloseAttacksByIds'
        - $ref: '#/components/schemas/Security_Detections_API_SetAttacksStatusByIdsBase'
      discriminator:
        propertyName: status
        mapping:
          closed: '#/components/schemas/Security_Detections_API_CloseAttacksByIds'
    Security_Detections_API_SetAttacksStatusByIdsBase:
      required:
        - ids
        - status
      type: object
      properties:
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
        status:
          $ref: '#/components/schemas/Security_Detections_API_AlertStatusExceptClosed'
        update_related_alerts:
          $ref: '#/components/schemas/Security_Detections_API_UpdateRelatedAlerts'
    Security_Detections_API_SetAttacksTagsByIds:
      required:
        - ids
        - tags
      type: object
      properties:
        ids:
          $ref: '#/components/schemas/Security_Detections_API_AlertIds'
        tags:
          $ref: '#/components/schemas/Security_Detections_API_SetAlertTags'
        update_related_alerts:
          $ref: '#/components/schemas/Security_Detections_API_UpdateRelatedAlerts'
    Security_Detections_API_SetupGuide:
      type: string
      description: 'Populates the rule’s setup guide with instructions on rule prerequisites such as required integrations, configuration steps, and anything else needed for the rule to work correctly.'
    Security_Detections_API_Severity:
      enum:
        - low
        - medium
        - high
        - critical
      type: string
      description: "Severity level of alerts produced by the rule, which must be one of the following:\n* `low`: Alerts that are of interest but generally not considered to be security incidents\n* `medium`: Alerts that require investigation\n* `high`: Alerts that require immediate investigation\n* `critical`: Alerts that indicate it is highly likely a security incident has occurred\n"
    Security_Detections_API_SeverityMapping:
      type: array
      items:
        required:
          - field
          - operator
          - severity
          - value
        type: object
        properties:
          field:
            type: string
            description: Source event field used to override the default `severity`.
          operator:
            enum:
              - equals
            type: string
          severity:
            $ref: '#/components/schemas/Security_Detections_API_Severity'
          value:
            type: string
      description: Overrides generated alerts' severity with values from the source event
    Security_Detections_API_SiemErrorResponse:
      required:
        - status_code
        - message
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
    Security_Detections_API_SkippedAlertsIndexMigration:
      required:
        - index
      type: object
      properties:
        index:
          type: string
    Security_Detections_API_SortOrder:
      enum:
        - asc
        - desc
      type: string
    Security_Detections_API_SuspendProcessParams:
      required:
        - command
        - config
      type: object
      properties:
        command:
          enum:
            - suspend-process
          type: string
          description: 'To run an endpoint response action, specify a value for the command field. Example: "command": "suspend-process"'
        comment:
          maxLength: 30000
          type: string
          description: 'Add a note that explains or describes the action. You can find your comment in the response actions history log. Example: "comment": "Check processes"'
        config:
          required:
            - field
          type: object
          properties:
            field:
              maxLength: 2000
              type: string
              description: Field to use instead of process.pid
            overwrite:
              type: boolean
              description: Whether to overwrite field with process.pid
              default: true
    Security_Detections_API_Threat:
      required:
        - framework
        - tactic
      type: object
      properties:
        framework:
          type: string
          description: Relevant attack framework
        tactic:
          $ref: '#/components/schemas/Security_Detections_API_ThreatTactic'
        technique:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_ThreatTechnique'
          description: Array containing information on the attack techniques (optional)
      description: "> info\n> Currently, only threats described using the MITRE ATT&CK&trade; framework are supported.\n"
    Security_Detections_API_ThreatArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Detections_API_Threat'
    Security_Detections_API_ThreatFilters:
      type: array
      items:
        description: Query and filter context array used to filter documents from the Elasticsearch index containing the threat values
    Security_Detections_API_ThreatIndex:
      type: array
      items:
        type: string
      description: Elasticsearch indices used to check which field values generate alerts.
    Security_Detections_API_ThreatIndicatorPath:
      type: string
      description: Defines the path to the threat indicator in the indicator documents (optional)
    Security_Detections_API_ThreatMapping:
      minItems: 1
      type: array
      items:
        required:
          - entries
        type: object
        properties:
          entries:
            type: array
            items:
              $ref: '#/components/schemas/Security_Detections_API_ThreatMappingEntry'
      description: "Array of entries objects that define mappings between the source event fields and the values in the Elasticsearch threat index. Each entries object must contain these fields:\n\n- field: field from the event indices on which the rule runs\n- type: must be mapping\n- value: field from the Elasticsearch threat index\n  \nYou can use Boolean and and or logic to define the conditions for when matching fields and values generate alerts. Sibling entries objects are evaluated using or logic, whereas multiple entries in a single entries object use and logic. See Example of Threat Match rule which uses both `and` and `or` logic.\n"
    Security_Detections_API_ThreatMappingEntry:
      required:
        - field
        - type
        - value
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
        negate:
          type: boolean
        type:
          enum:
            - mapping
          type: string
        value:
          $ref: '#/components/schemas/Security_Detections_API_NonEmptyString'
    Security_Detections_API_ThreatMatchRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleResponseFields'
    Security_Detections_API_ThreatMatchRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields'
    Security_Detections_API_ThreatMatchRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields'
    Security_Detections_API_ThreatMatchRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ThreatMatchRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppression'
        concurrent_searches:
          $ref: '#/components/schemas/Security_Detections_API_ConcurrentSearches'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        items_per_search:
          $ref: '#/components/schemas/Security_Detections_API_ItemsPerSearch'
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
        threat_filters:
          $ref: '#/components/schemas/Security_Detections_API_ThreatFilters'
        threat_indicator_path:
          $ref: '#/components/schemas/Security_Detections_API_ThreatIndicatorPath'
        threat_language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ThreatMatchRulePatchFields:
      allOf:
        - type: object
          properties:
            query:
              $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
            threat_index:
              $ref: '#/components/schemas/Security_Detections_API_ThreatIndex'
            threat_mapping:
              $ref: '#/components/schemas/Security_Detections_API_ThreatMapping'
            threat_query:
              $ref: '#/components/schemas/Security_Detections_API_ThreatQuery'
            type:
              enum:
                - threat_match
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleDefaultableFields'
    Security_Detections_API_ThreatMatchRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRulePatchFields'
    Security_Detections_API_ThreatMatchRuleRequiredFields:
      required:
        - type
        - query
        - threat_query
        - threat_mapping
        - threat_index
      type: object
      properties:
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        threat_index:
          $ref: '#/components/schemas/Security_Detections_API_ThreatIndex'
        threat_mapping:
          $ref: '#/components/schemas/Security_Detections_API_ThreatMapping'
        threat_query:
          $ref: '#/components/schemas/Security_Detections_API_ThreatQuery'
        type:
          enum:
            - threat_match
          type: string
          description: Rule type
    Security_Detections_API_ThreatMatchRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleOptionalFields'
        - required:
            - language
          type: object
          properties:
            language:
              $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ThreatMatchRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ThreatMatchRuleCreateFields'
    Security_Detections_API_ThreatQuery:
      type: string
      description: Query used to determine which fields in the Elasticsearch index are used for generating alerts.
    Security_Detections_API_ThreatSubtechnique:
      required:
        - id
        - name
        - reference
      type: object
      properties:
        id:
          type: string
          description: Subtechnique ID
        name:
          type: string
          description: Subtechnique name
        reference:
          type: string
          description: Subtechnique reference
    Security_Detections_API_ThreatTactic:
      required:
        - id
        - name
        - reference
      type: object
      properties:
        id:
          type: string
          description: Tactic ID
        name:
          type: string
          description: Tactic name
        reference:
          type: string
          description: Tactic reference
      description: "Object containing information on the attack type\n"
    Security_Detections_API_ThreatTechnique:
      required:
        - id
        - name
        - reference
      type: object
      properties:
        id:
          type: string
          description: Technique ID
        name:
          type: string
          description: Technique name
        reference:
          type: string
          description: Technique reference
        subtechnique:
          type: array
          items:
            $ref: '#/components/schemas/Security_Detections_API_ThreatSubtechnique'
          description: "Array containing more specific information on the attack technique.\n"
    Security_Detections_API_Threshold:
      required:
        - field
        - value
      type: object
      properties:
        cardinality:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdCardinality'
        field:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdField'
        value:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdValue'
    Security_Detections_API_ThresholdAlertSuppression:
      required:
        - duration
      type: object
      properties:
        duration:
          $ref: '#/components/schemas/Security_Detections_API_AlertSuppressionDuration'
      description: Defines alert suppression configuration.
    Security_Detections_API_ThresholdCardinality:
      type: array
      items:
        required:
          - field
          - value
        type: object
        properties:
          field:
            type: string
            description: The field on which to calculate and compare the cardinality.
          value:
            minimum: 0
            type: integer
            description: The threshold value from which an alert is generated based on unique number of values of cardinality.field.
      description: The field on which the cardinality is applied.
    Security_Detections_API_ThresholdField:
      oneOf:
        - type: string
        - maxItems: 5
          minItems: 0
          type: array
          items:
            type: string
      description: 'The field on which the threshold is applied. If you specify an empty array ([]), alerts are generated when the query returns at least the number of results specified in the value field.'
    Security_Detections_API_ThresholdRule:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
            - version
            - tags
            - enabled
            - risk_score_mapping
            - severity_mapping
            - interval
            - from
            - to
            - actions
            - exceptions_list
            - author
            - false_positives
            - references
            - max_signals
            - threat
            - setup
            - related_integrations
            - required_fields
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ResponseFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleResponseFields'
    Security_Detections_API_ThresholdRuleCreateFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields'
    Security_Detections_API_ThresholdRuleCreateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields'
    Security_Detections_API_ThresholdRuleDefaultableFields:
      type: object
      properties:
        language:
          $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ThresholdRuleOptionalFields:
      type: object
      properties:
        alert_suppression:
          $ref: '#/components/schemas/Security_Detections_API_ThresholdAlertSuppression'
        data_view_id:
          $ref: '#/components/schemas/Security_Detections_API_DataViewId'
        filters:
          $ref: '#/components/schemas/Security_Detections_API_RuleFilterArray'
        index:
          $ref: '#/components/schemas/Security_Detections_API_IndexPatternArray'
        saved_id:
          $ref: '#/components/schemas/Security_Detections_API_SavedQueryId'
    Security_Detections_API_ThresholdRulePatchFields:
      allOf:
        - type: object
          properties:
            query:
              $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
            threshold:
              $ref: '#/components/schemas/Security_Detections_API_Threshold'
            type:
              enum:
                - threshold
              type: string
              description: Rule type
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleDefaultableFields'
    Security_Detections_API_ThresholdRulePatchProps:
      allOf:
        - type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRulePatchFields'
    Security_Detections_API_ThresholdRuleRequiredFields:
      required:
        - type
        - query
        - threshold
      type: object
      properties:
        query:
          $ref: '#/components/schemas/Security_Detections_API_RuleQuery'
        threshold:
          $ref: '#/components/schemas/Security_Detections_API_Threshold'
        type:
          enum:
            - threshold
          type: string
          description: Rule type
    Security_Detections_API_ThresholdRuleResponseFields:
      allOf:
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleRequiredFields'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleOptionalFields'
        - required:
            - language
          type: object
          properties:
            language:
              $ref: '#/components/schemas/Security_Detections_API_KqlQueryLanguage'
    Security_Detections_API_ThresholdRuleUpdateProps:
      allOf:
        - required:
            - name
            - description
            - risk_score
            - severity
          type: object
          properties:
            actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleAction'
              description: Array defining the automated actions (notifications) taken when alerts are generated.
            alias_purpose:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasPurpose'
            alias_target_id:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveAliasTargetId'
            author:
              $ref: '#/components/schemas/Security_Detections_API_RuleAuthorArray'
            building_block_type:
              $ref: '#/components/schemas/Security_Detections_API_BuildingBlockType'
            description:
              $ref: '#/components/schemas/Security_Detections_API_RuleDescription'
            enabled:
              $ref: '#/components/schemas/Security_Detections_API_IsRuleEnabled'
            exceptions_list:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RuleExceptionList'
            false_positives:
              $ref: '#/components/schemas/Security_Detections_API_RuleFalsePositiveArray'
            from:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalFrom'
            id:
              $ref: '#/components/schemas/Security_Detections_API_UUID'
            interval:
              $ref: '#/components/schemas/Security_Detections_API_RuleInterval'
            investigation_fields:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationFields'
            license:
              $ref: '#/components/schemas/Security_Detections_API_RuleLicense'
            max_signals:
              $ref: '#/components/schemas/Security_Detections_API_MaxSignals'
            meta:
              $ref: '#/components/schemas/Security_Detections_API_RuleMetadata'
            name:
              $ref: '#/components/schemas/Security_Detections_API_RuleName'
            namespace:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndexNamespace'
            note:
              $ref: '#/components/schemas/Security_Detections_API_InvestigationGuide'
            outcome:
              $ref: '#/components/schemas/Security_Detections_API_SavedObjectResolveOutcome'
            output_index:
              $ref: '#/components/schemas/Security_Detections_API_AlertsIndex'
            references:
              $ref: '#/components/schemas/Security_Detections_API_RuleReferenceArray'
            related_integrations:
              $ref: '#/components/schemas/Security_Detections_API_RelatedIntegrationArray'
            required_fields:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_RequiredFieldInput'
              description: "Elasticsearch fields and their types that need to be present for the rule to function.\n> info\n> The value of `required_fields` does not affect the rule’s behavior, and specifying it incorrectly won’t cause the rule to fail. Use `required_fields` as an informational property to document the fields that the rule expects to be present in the data.\n"
            response_actions:
              type: array
              items:
                $ref: '#/components/schemas/Security_Detections_API_ResponseAction'
            risk_score:
              $ref: '#/components/schemas/Security_Detections_API_RiskScore'
            risk_score_mapping:
              $ref: '#/components/schemas/Security_Detections_API_RiskScoreMapping'
            rule_id:
              $ref: '#/components/schemas/Security_Detections_API_RuleSignatureId'
            rule_name_override:
              $ref: '#/components/schemas/Security_Detections_API_RuleNameOverride'
            setup:
              $ref: '#/components/schemas/Security_Detections_API_SetupGuide'
            severity:
              $ref: '#/components/schemas/Security_Detections_API_Severity'
            severity_mapping:
              $ref: '#/components/schemas/Security_Detections_API_SeverityMapping'
            tags:
              $ref: '#/components/schemas/Security_Detections_API_RuleTagArray'
            threat:
              $ref: '#/components/schemas/Security_Detections_API_ThreatArray'
            throttle:
              $ref: '#/components/schemas/Security_Detections_API_RuleActionThrottle'
            timeline_id:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateId'
            timeline_title:
              $ref: '#/components/schemas/Security_Detections_API_TimelineTemplateTitle'
            timestamp_override:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverride'
            timestamp_override_fallback_disabled:
              $ref: '#/components/schemas/Security_Detections_API_TimestampOverrideFallbackDisabled'
            to:
              $ref: '#/components/schemas/Security_Detections_API_RuleIntervalTo'
            version:
              $ref: '#/components/schemas/Security_Detections_API_RuleVersion'
        - $ref: '#/components/schemas/Security_Detections_API_ThresholdRuleCreateFields'
    Security_Detections_API_ThresholdValue:
      minimum: 1
      type: integer
      description: The threshold value from which an alert is generated.
    Security_Detections_API_ThrottleForBulkActions:
      enum:
        - rule
        - 1h
        - 1d
        - 7d
      type: string
      description: "Defines the maximum interval in which a rule’s actions are executed.\n> info\n> The rule level `throttle` field is deprecated in Elastic Security 8.8 and will remain active for at least the next 12 months.\n> In Elastic Security 8.8 and later, you can use the `frequency` field to define frequencies for individual actions. Actions without frequencies will acquire a converted version of the rule’s `throttle` field. In the response, the converted `throttle` setting appears in the individual actions' `frequency` field.\n"
    Security_Detections_API_TiebreakerField:
      type: string
      description: Sets a secondary field for sorting events
    Security_Detections_API_TimelineTemplateId:
      type: string
      description: Timeline template ID
    Security_Detections_API_TimelineTemplateTitle:
      type: string
      description: Timeline template title
    Security_Detections_API_TimestampField:
      type: string
      description: 'Specifies the name of the event timestamp field used for sorting a sequence of events. Not to be confused with `timestamp_override`, which specifies the more general field used for querying events within a range. Defaults to the @timestamp ECS field.'
    Security_Detections_API_TimestampOverride:
      type: string
      description: 'Sets the time field used to query indices. When unspecified, rules query the `@timestamp` field. The source field must be an Elasticsearch date data type.'
    Security_Detections_API_TimestampOverrideFallbackDisabled:
      type: boolean
      description: Disables the fallback to the event's @timestamp field
    Security_Detections_API_UpdateRelatedAlerts:
      type: boolean
      description: 'When `true`, the change is also applied to detection alerts related to the attacks via `kibana.alert.attack_discovery.alert_ids`.'
      default: false
    Security_Detections_API_UUID:
      type: string
      description: A universally unique identifier
      format: uuid
    Security_Detections_API_WarningSchema:
      required:
        - type
        - message
        - actionPath
      type: object
      properties:
        actionPath:
          type: string
        buttonLabel:
          type: string
        message:
          type: string
        type:
          type: string
    Security_Endpoint_Exceptions_API_EndpointList:
      oneOf:
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionList'
        - type: object
          additionalProperties: false
    Security_Endpoint_Exceptions_API_EndpointListItem:
      $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItem'
    Security_Endpoint_Exceptions_API_ExceptionList:
      required:
        - id
        - list_id
        - type
        - name
        - description
        - immutable
        - namespace_type
        - version
        - tie_breaker_id
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        _version:
          type: string
          description: 'The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
        created_by:
          type: string
          description: Autogenerated value - user that created object.
        description:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListDescription'
        id:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListId'
        immutable:
          type: boolean
        list_id:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListHumanId'
        meta:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListMeta'
        name:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListName'
        namespace_type:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListTags'
        tie_breaker_id:
          type: string
          description: Field used in search to ensure all containers are sorted and returned correctly.
        type:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListType'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
        updated_by:
          type: string
          description: Autogenerated value - user that last updated object.
        version:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListVersion'
    Security_Endpoint_Exceptions_API_ExceptionListDescription:
      type: string
      description: Describes the exception list.
      example: This list tracks allowlisted values.
    Security_Endpoint_Exceptions_API_ExceptionListHumanId:
      minLength: 1
      type: string
      description: "The exception list's human-readable string identifier.\n\nFor endpoint artifacts, use one of the following values:\n\n* `endpoint_list`: Elastic Endpoint exceptions list\n* `endpoint_trusted_apps`: Trusted applications list\n* `endpoint_trusted_devices`: Trusted devices list\n* `endpoint_event_filters`: Event filters list\n* `endpoint_host_isolation_exceptions`: Host isolation exceptions list\n* `endpoint_blocklists`: Blocklist\n"
      format: nonempty
      example: simple_list
    Security_Endpoint_Exceptions_API_ExceptionListId:
      minLength: 1
      type: string
      description: Exception list's identifier.
      format: nonempty
      example: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
    Security_Endpoint_Exceptions_API_ExceptionListItem:
      required:
        - id
        - item_id
        - list_id
        - type
        - name
        - description
        - entries
        - namespace_type
        - comments
        - tie_breaker_id
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        _version:
          type: string
          description: 'The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.'
        comments:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
        created_by:
          type: string
          description: Autogenerated value - user that created object.
        description:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemDescription'
        entries:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray'
        expire_time:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemExpireTime'
        id:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemId'
        item_id:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemHumanId'
        list_id:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListHumanId'
        meta:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemTags'
        tie_breaker_id:
          type: string
          description: Field used in search to ensure all containers are sorted and returned correctly.
        type:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemType'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
        updated_by:
          type: string
          description: Autogenerated value - user that last updated object.
    Security_Endpoint_Exceptions_API_ExceptionListItemComment:
      required:
        - id
        - comment
        - created_at
        - created_by
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
        created_by:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        id:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
        updated_by:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
    Security_Endpoint_Exceptions_API_ExceptionListItemCommentArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemComment'
      description: "Array of comment fields:\n\n- comment (string): Comments about the exception item.\n"
    Security_Endpoint_Exceptions_API_ExceptionListItemDescription:
      type: string
      description: Describes the exception list.
    Security_Endpoint_Exceptions_API_ExceptionListItemEntry:
      anyOf:
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryList'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard'
      discriminator:
        propertyName: type
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntry'
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists:
      required:
        - type
        - field
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - exists
          type: string
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryList:
      required:
        - type
        - field
        - list
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        list:
          required:
            - id
            - type
          type: object
          properties:
            id:
              $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ListId'
            type:
              $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ListType'
        operator:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - list
          type: string
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch:
      required:
        - type
        - field
        - value
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - match
          type: string
        value:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny:
      required:
        - type
        - field
        - value
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - match_any
          type: string
        value:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchWildcard:
      required:
        - type
        - field
        - value
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - wildcard
          type: string
        value:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryNested:
      required:
        - type
        - field
        - entries
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem'
        field:
          $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
        type:
          enum:
            - nested
          type: string
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryNestedEntryItem:
      oneOf:
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatch'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryMatchAny'
        - $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListItemEntryExists'
    Security_Endpoint_Exceptions_API_ExceptionListItemEntryOperator:
      enum:
        - excluded
        - included
      type: string
    Security_Endpoint_Exceptions_API_ExceptionListItemExpireTime:
      type: string
      description: 'The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.'
      format: date-time
    Security_Endpoint_Exceptions_API_ExceptionListItemHumanId:
      minLength: 1
      type: string
      description: 'Human readable string identifier, e.g. `trusted-linux-processes`'
      format: nonempty
      example: simple_list_item
    Security_Endpoint_Exceptions_API_ExceptionListItemId:
      minLength: 1
      type: string
      description: Exception's identifier.
      format: nonempty
      example: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
    Security_Endpoint_Exceptions_API_ExceptionListItemMeta:
      type: object
    Security_Endpoint_Exceptions_API_ExceptionListItemName:
      minLength: 1
      type: string
      description: Exception list name.
      format: nonempty
    Security_Endpoint_Exceptions_API_ExceptionListItemOsTypeArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType'
    Security_Endpoint_Exceptions_API_ExceptionListItemTags:
      type: array
      items:
        minLength: 1
        type: string
        description: String array containing words and phrases to help categorize exception items.
        format: nonempty
    Security_Endpoint_Exceptions_API_ExceptionListItemType:
      enum:
        - simple
      type: string
    Security_Endpoint_Exceptions_API_ExceptionListMeta:
      type: object
      description: Placeholder for metadata about the list container.
    Security_Endpoint_Exceptions_API_ExceptionListName:
      type: string
      description: The name of the exception list.
      example: My exception list
    Security_Endpoint_Exceptions_API_ExceptionListOsType:
      enum:
        - linux
        - macos
        - windows
      type: string
      description: Use this field to specify the operating system.
    Security_Endpoint_Exceptions_API_ExceptionListOsTypeArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_ExceptionListOsType'
      description: Use this field to specify the operating system. Only enter one value.
    Security_Endpoint_Exceptions_API_ExceptionListTags:
      type: array
      items:
        type: string
      description: String array containing words and phrases to help categorize exception containers.
    Security_Endpoint_Exceptions_API_ExceptionListType:
      enum:
        - detection
        - rule_default
        - endpoint
        - endpoint_trusted_apps
        - endpoint_trusted_devices
        - endpoint_events
        - endpoint_host_isolation_exceptions
        - endpoint_blocklists
        - endpoint_custom_yara_signatures
      type: string
      description: The type of exception list to be created. Different list types may denote where they can be utilized.
    Security_Endpoint_Exceptions_API_ExceptionListVersion:
      minimum: 1
      type: integer
      description: 'The document version, automatically increasd on updates.'
    Security_Endpoint_Exceptions_API_ExceptionNamespaceType:
      enum:
        - agnostic
        - single
      type: string
      description: "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n\nFor endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.\n"
    Security_Endpoint_Exceptions_API_FindEndpointListItemsFilter:
      $ref: '#/components/schemas/Security_Endpoint_Exceptions_API_NonEmptyString'
    Security_Endpoint_Exceptions_API_ListId:
      minLength: 1
      type: string
      description: Value list's identifier.
      format: nonempty
      example: 21b01cfb-058d-44b9-838c-282be16c91cd
    Security_Endpoint_Exceptions_API_ListType:
      enum:
        - binary
        - boolean
        - byte
        - date
        - date_nanos
        - date_range
        - double
        - double_range
        - float
        - float_range
        - geo_point
        - geo_shape
        - half_float
        - integer
        - integer_range
        - ip
        - ip_range
        - keyword
        - long
        - long_range
        - shape
        - short
        - text
      type: string
      description: "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:\n\n- `keyword`: Many ECS fields are Elasticsearch keywords\n- `ip`: IP addresses\n- `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)\n"
    Security_Endpoint_Exceptions_API_NonEmptyString:
      minLength: 1
      type: string
      description: A string that does not contain only whitespace characters
      format: nonempty
    Security_Endpoint_Exceptions_API_PlatformErrorResponse:
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
    Security_Endpoint_Exceptions_API_SiemErrorResponse:
      required:
        - status_code
        - message
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
    Security_Endpoint_Management_API_ActionDetailsResponse:
      oneOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Execute'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Upload'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Scan'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Cancel'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Isolate'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_Unisolate'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
      discriminator:
        propertyName: command
        mapping:
          cancel: '#/components/schemas/Security_Endpoint_Management_API_Cancel'
          execute: '#/components/schemas/Security_Endpoint_Management_API_Execute'
          get-file: '#/components/schemas/Security_Endpoint_Management_API_GetFile'
          isolate: '#/components/schemas/Security_Endpoint_Management_API_Isolate'
          kill-process: '#/components/schemas/Security_Endpoint_Management_API_KillProcess'
          memory-dump: '#/components/schemas/Security_Endpoint_Management_API_MemoryDump'
          running-processes: '#/components/schemas/Security_Endpoint_Management_API_RunningProcesses'
          runscript: '#/components/schemas/Security_Endpoint_Management_API_Runscript'
          scan: '#/components/schemas/Security_Endpoint_Management_API_Scan'
          suspend-process: '#/components/schemas/Security_Endpoint_Management_API_SuspendProcess'
          unisolate: '#/components/schemas/Security_Endpoint_Management_API_Unisolate'
          upload: '#/components/schemas/Security_Endpoint_Management_API_Upload'
    Security_Endpoint_Management_API_ActionStateSuccessResponse:
      required:
        - data
      type: object
      properties:
        data:
          type: object
          properties:
            canEncrypt:
              type: boolean
              description: Whether the Kibana instance has encryption enabled for response actions.
    Security_Endpoint_Management_API_ActionStatusSuccessResponse:
      required:
        - data
      type: object
      properties:
        data:
          type: array
          items:
            required:
              - agent_id
              - pending_actions
            type: object
            properties:
              agent_id:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentId'
              pending_actions:
                $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionsSchema'
          description: One pending-actions summary entry per requested agent.
    Security_Endpoint_Management_API_AgentId:
      maxLength: 256
      type: string
      description: Agent ID
    Security_Endpoint_Management_API_AgentIds:
      minLength: 1
      oneOf:
        - maxItems: 250
          minItems: 1
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
        - maxLength: 256
          minLength: 1
          type: string
      description: A list of agent IDs. Max of 250.
      example:
        - agent-id-1
        - agent-id-2
    Security_Endpoint_Management_API_AgentTypes:
      enum:
        - endpoint
        - sentinel_one
        - crowdstrike
        - microsoft_defender_endpoint
      type: string
      description: List of agent types to retrieve. Defaults to `endpoint`.
      example: endpoint
    Security_Endpoint_Management_API_ApiPageSize:
      maximum: 1000
      minimum: 1
      type: integer
      description: Number of items per page
      default: 10
      example: 10
    Security_Endpoint_Management_API_ApiSortField:
      enum:
        - name
        - createdAt
        - createdBy
        - updatedAt
        - updatedBy
        - fileSize
      type: string
      description: Determines which field is used to sort the results.
      example: updatedAt
    Security_Endpoint_Management_API_ArchivePathToExecutableSchema:
      maxLength: 4096
      type: string
      description: Used only for when the uploaded script is an archive (.zip file for example). This property defines the relative path to the file included in the archive that should be executed once its contents are extracted. The path should be relative to the root of the archive.
      example: ./bin/script.sh
    Security_Endpoint_Management_API_Cancel:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    type: object
                    properties:
                      code:
                        type: string
            parameters:
              type: object
              properties:
                id:
                  type: string
                  format: uuid
    Security_Endpoint_Management_API_CancelRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              oneOf:
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_ElasticDefendCancelParameters'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_MDECancelParameters'
    Security_Endpoint_Management_API_CloudFileScriptParameters:
      required:
        - cloudFile
      type: object
      properties:
        cloudFile:
          maxLength: 4096
          minLength: 1
          type: string
          description: Script name in cloud storage.
        commandLine:
          maxLength: 8192
          minLength: 1
          type: string
          description: Command line arguments.
        timeout:
          minimum: 1
          type: integer
          description: Timeout in seconds.
    Security_Endpoint_Management_API_Command:
      minLength: 1
      enum:
        - isolate
        - unisolate
        - kill-process
        - suspend-process
        - running-processes
        - get-file
        - execute
        - upload
        - scan
        - runscript
        - cancel
        - memory-dump
      type: string
      description: The command for the response action
    Security_Endpoint_Management_API_Commands:
      maxItems: 50
      type: array
      items:
        $ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
      description: A list of response action command names.
      example:
        - isolate
        - unisolate
    Security_Endpoint_Management_API_Comment:
      maxLength: 30000
      type: string
      description: Optional comment
      example: This is a comment
    Security_Endpoint_Management_API_CreateScriptRouteRequestBody:
      required:
        - name
        - platform
        - file
        - fileType
      type: object
      properties:
        description:
          maxLength: 10000
          type: string
          description: Description of the script and its purpose/functionality
        example:
          maxLength: 10000
          type: string
          description: Example usage of the script
        file:
          type: object
          description: The script file upload
          format: binary
        fileType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptFileType'
        instructions:
          maxLength: 10000
          type: string
          description: 'Instructions for using the script, including details around its supported input arguments'
        name:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptNameSchema'
        pathToExecutable:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ArchivePathToExecutableSchema'
        platform:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform'
          description: Platforms supported by the the script
        requiresInput:
          type: boolean
          description: Whether the script requires input arguments
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags'
          description: Tags to categorize the script
    Security_Endpoint_Management_API_DownloadUri:
      type: object
      properties:
        downloadUri:
          type: string
          description: "The server relative URI to download the file associated with the output of the response action.\nURI does **not** include the space prefix\n"
          format: uri-reference
          example: /api/endpoint/action/497f6eca-6276/file/35645-6276-4993/download
    Security_Endpoint_Management_API_ElasticDefendCancelParameters:
      title: ElasticDefendCancelParameters
      required:
        - id
      type: object
      properties:
        force:
          type: boolean
          description: Forcefully cancel the response action even when it is already running
          example: true
        id:
          maxLength: 50
          minLength: 1
          type: string
          description: ID of the response action to cancel
          example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
      description: Elastic Defend agent type
    Security_Endpoint_Management_API_EndDate:
      maxLength: 64
      type: string
      description: An end date in ISO format or Date Math format.
      example: '2023-10-31T23:59:59.999Z'
    Security_Endpoint_Management_API_EndpointIds:
      maxItems: 250
      minItems: 1
      type: array
      items:
        maxLength: 256
        minLength: 1
        type: string
      description: List of endpoint IDs (cannot contain empty strings). Max of 250.
      example:
        - endpoint-id-1
        - endpoint-id-2
    Security_Endpoint_Management_API_EndpointMetadataResponse:
      type: object
      example:
        host_status: healthy
        last_checkin: '2023-07-04T15:48:57.360Z'
        metadata:
          '@timestamp': '2023-07-04T15:48:57.3609346Z'
          agent:
            build:
              original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
            id: abb8a826-6812-448c-a571-6d8269b51449
            type: endpoint
            version: '7.16.0'
          data_stream:
            dataset: endpoint.metadata
            namespace: default
            type: metrics
          ecs:
            version: '1.11.0'
          elastic:
            agent:
              id: abb8a826-6812-448c-a571-6d8269b51449
          Endpoint:
            capabilities:
              - isolation
            configuration:
              isolation: false
            policy:
              applied:
                endpoint_policy_version: '2'
                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                name: test
                status: success
                version: '3'
            state:
              isolation: false
            status: enrolled
          event:
            action: endpoint_metadata
            agent_id_status: verified
            category:
              - host
            created: '2023-07-04T15:48:57.3609346Z'
            dataset: endpoint.metadata
            id: MNtRc++KoKHXXwlj+++++OhZ
            ingested: '2023-07-04T15:48:58Z'
            kind: metric
            module: endpoint
            sequence: 43757
            type:
              - info
          host:
            architecture: x86_64
            hostname: WinDev2104Eval
            id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
            ip:
              - 10.0.2.15
              - fe80::21a6:63d3:d70e:e3ad
              - 127.0.0.1
              - '::1'
            mac:
              - 08:00:27:b1:1d:5a
            name: WinDev2104Eval
            os:
              Ext:
                variant: Windows 10 Enterprise Evaluation
              family: windows
              full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
              kernel: 20H2 (10.0.19042.906)
              name: Windows
              platform: windows
              type: windows
              version: 20H2 (10.0.19042.906)
          message: Endpoint metadata
          policy_info:
            agent:
              applied:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
              configured:
                id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                revision: 3
            endpoint:
              id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
              revision: 2
    Security_Endpoint_Management_API_EndpointRunScriptParameters:
      title: Elastic Defend Run Script Parameters
      required:
        - scriptId
      type: object
      properties:
        scriptId:
          maxLength: 256
          minLength: 1
          type: string
          description: The script ID from the scripts library that will be executed.
        scriptInput:
          maxLength: 8192
          minLength: 1
          type: string
          description: The input parameter arguments (if any) for the script that will be executed.
      description: Parameters for Run Script response action against Elastic Defend agent type.
      example:
        agent_type: endpoint
        endpoint_ids:
          - endpoint-id-1
        parameters:
          scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
          scriptInput: '--some-parameter some-value'
    Security_Endpoint_Management_API_EndpointScript:
      type: object
      properties:
        createdAt:
          type: string
          format: date-time
        createdBy:
          type: string
          example: elastic
        description:
          type: string
          description: Description of the script and its purpose/functionality
          example: Collects host data for investigation
        downloadUri:
          type: string
          description: URI to download the script file. Note that this is the relative path and does not include the space (if applicable)
          example: /api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download
        example:
          type: string
        fileHash:
          type: string
          description: SHA256 hash of the script file that was uploaded
          example: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
        fileName:
          type: string
          description: Name of the script file that was uploaded
          example: collect_host_data.sh
        fileSize:
          type: integer
          description: Size of the script file that was uploaded in bytes
          example: 12345
        id:
          type: string
          format: uuid
          example: 123e4567-e89b-12d3-a456-426655440000
        instructions:
          type: string
          description: 'Instructions for using the script, including details around its supported input arguments'
        name:
          type: string
          example: Collect host data
        pathToExecutable:
          type: string
          description: "The relative path to the file included in the archive that should be executed once its contents are extracted. Applicable only for scripts uploaded as an archive (.zip file for example).\n"
        platform:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform'
        requiresInput:
          type: boolean
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags'
          description: Tags that categorize the script
        updatedAt:
          type: string
          format: date-time
        updatedBy:
          type: string
          example: admin
        version:
          type: string
    Security_Endpoint_Management_API_EndpointScriptFileType:
      enum:
        - script
        - archive
      type: string
      description: 'The type of the uploaded file, which determines the expected value of `pathToExecutable`. If `fileType` is "script", then `pathToExecutable` should not be included. If `fileType` is "archive", then `pathToExecutable` is required and should specify the path to the executable file within the archive.'
    Security_Endpoint_Management_API_EndpointScriptPlatform:
      enum:
        - linux
        - macos
        - windows
      type: string
    Security_Endpoint_Management_API_EndpointScriptTags:
      enum:
        - remediationAction
        - dataCollection
        - networkDiagnostics
        - networkAction
        - systemInventory
        - forensicCollection
        - threatHunting
        - discovery
        - systemManagement
        - userManagement
        - troubleshooting
      type: string
    Security_Endpoint_Management_API_Execute:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    allOf:
                      - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                      - type: object
                        properties:
                          code:
                            type: string
                          cwd:
                            type: string
                          output_file_id:
                            type: string
                          output_file_stderr_truncated:
                            type: boolean
                          output_file_stdout_truncated:
                            type: boolean
                          shell_code:
                            type: number
                          stderr:
                            type: string
                          stderr_truncated:
                            type: boolean
                          stdout:
                            type: string
                          stdout_truncated:
                            type: boolean
            parameters:
              type: object
              properties:
                command:
                  type: string
                timeout:
                  type: number
    Security_Endpoint_Management_API_ExecuteRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              required:
                - command
              type: object
              properties:
                command:
                  maxLength: 8192
                  minLength: 1
                  type: string
                  description: The shell command to execute on the endpoint.
                timeout:
                  minimum: 1
                  type: integer
                  description: The maximum timeout value in seconds before the command is terminated.
    Security_Endpoint_Management_API_GetEndpointActionListResponse:
      type: object
      properties:
        agentTypes:
          type: array
          items:
            type: string
          description: The list of agent types the query was filtered by.
        commands:
          type: array
          items:
            type: string
          description: The list of commands the query was filtered by.
        data:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
          description: The list of response actions.
        elasticAgentIds:
          type: array
          items:
            type: string
          description: The list of elastic agent IDs the query was filtered by.
        endDate:
          type: string
          description: The end date filter applied to the query.
        page:
          type: integer
          description: The current page number.
        pageSize:
          type: integer
          description: The number of items per page.
        startDate:
          type: string
          description: The start date filter applied to the query.
        statuses:
          type: array
          items:
            type: string
          description: The list of statuses the query was filtered by.
        total:
          type: integer
          description: The total number of response actions matching the query.
        userIds:
          type: array
          items:
            type: string
          description: The list of user IDs the query was filtered by.
      example:
        data:
          - agents:
              - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
            agentType: endpoint
            command: running-processes
            completedAt: '2022-08-08T09:50:47.672Z'
            createdBy: elastic
            id: b3d6de74-36b0-4fa8-be46-c375bf1771bf
            isCompleted: true
            isExpired: false
            startedAt: '2022-08-08T15:24:57.402Z'
            wasSuccessful: true
          - agents:
              - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
            agentType: endpoint
            command: isolate
            completedAt: '2022-08-08T10:41:57.352Z'
            createdBy: elastic
            id: 43b4098b-8752-4fbb-a7a7-6df7c74d0ee3
            isCompleted: true
            isExpired: false
            startedAt: '2022-08-08T15:23:37.359Z'
            wasSuccessful: true
          - agents:
              - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
            agentType: endpoint
            command: kill-process
            comment: bad process - taking up too much cpu
            completedAt: '2022-08-08T09:44:50.952Z'
            createdBy: elastic
            id: 5bc92c86-b8e6-42dd-837f-12ad29e09caa
            isCompleted: true
            isExpired: false
            startedAt: '2022-08-08T14:38:44.125Z'
            wasSuccessful: true
          - agents:
              - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
            agentType: endpoint
            command: unisolate
            comment: Not a threat to the network
            completedAt: '2022-08-08T09:40:47.398Z'
            createdBy: elastic
            id: 790d54e0-3aa3-4e5b-8255-3ce9d851246a
            isCompleted: true
            isExpired: false
            startedAt: '2022-08-08T14:38:15.391Z'
            wasSuccessful: true
        elasticAgentIds:
          - afdc366c-e2e0-4cdb-ae1d-94575bd2d8e0
        endDate: now
        page: 1
        pageSize: 10
        startDate: now-24h/h
        total: 4
    Security_Endpoint_Management_API_GetFile:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    allOf:
                      - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                      - type: object
                        properties:
                          code:
                            type: string
                          contents:
                            type: array
                            items:
                              type: object
                              properties:
                                file_name:
                                  type: string
                                path:
                                  type: string
                                sha256:
                                  type: string
                                size:
                                  type: number
                                type:
                                  type: string
                          zip_size:
                            type: number
            parameters:
              type: object
              properties:
                path:
                  type: string
    Security_Endpoint_Management_API_GetFileRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              required:
                - path
              type: object
              properties:
                path:
                  maxLength: 4096
                  minLength: 1
                  type: string
                  description: The full file path to retrieve from the endpoint.
    Security_Endpoint_Management_API_GetProcessesRouteRequestBody:
      required:
        - endpoint_ids
      type: object
      properties:
        agent_type:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        alert_ids:
          maxItems: 50
          minItems: 1
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
          description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
          example:
            - alert-id-1
            - alert-id-2
        case_ids:
          maxItems: 50
          minItems: 1
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
          description: The IDs of cases where the action taken will be logged. Max of 50.
          example:
            - case-id-1
            - case-id-2
        comment:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
        endpoint_ids:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
        parameters:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
    Security_Endpoint_Management_API_HostPathScriptParameters:
      required:
        - hostPath
      type: object
      properties:
        commandLine:
          maxLength: 8192
          minLength: 1
          type: string
          description: Command line arguments.
        hostPath:
          maxLength: 4096
          minLength: 1
          type: string
          description: Absolute or relative path of script on host machine.
        timeout:
          minimum: 1
          type: integer
          description: Timeout in seconds.
    Security_Endpoint_Management_API_HostStatuses:
      maxItems: 20
      type: array
      items:
        enum:
          - healthy
          - offline
          - updating
          - inactive
          - unenrolled
        type: string
      description: A set of agent health statuses to filter by.
      example:
        - healthy
        - updating
    Security_Endpoint_Management_API_Isolate:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          description: Details of an isolate action response.
    Security_Endpoint_Management_API_IsolateRouteResponse:
      type: object
      properties:
        action:
          type: string
          description: 'The action ID (legacy field, same as `data.id`).'
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_KillProcess:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    oneOf:
                      - type: object
                        properties:
                          code:
                            type: string
                          command:
                            type: string
                          pid:
                            type: number
                      - type: object
                        properties:
                          code:
                            type: string
                          command:
                            type: string
                          entity_id:
                            type: string
                      - type: object
                        properties:
                          code:
                            type: string
                          command:
                            type: string
                          process_name:
                            type: string
            parameters:
              oneOf:
                - type: object
                  properties:
                    pid:
                      minimum: 1
                      type: number
                      description: The process ID (PID) of the process to terminate.
                - type: object
                  properties:
                    entity_id:
                      minLength: 1
                      type: string
                      description: The entity ID of the process to terminate.
                - type: object
                  properties:
                    process_name:
                      type: string
                      description: The name of the process to terminate. Valid for SentinelOne agent type only.
    Security_Endpoint_Management_API_KillProcessRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              oneOf:
                - type: object
                  properties:
                    pid:
                      minimum: 1
                      type: integer
                      description: The process ID (PID) of the process to terminate.
                      example: 123
                - type: object
                  properties:
                    entity_id:
                      maxLength: 256
                      minLength: 1
                      type: string
                      description: The entity ID of the process to terminate.
                      example: abc123
                - type: object
                  properties:
                    process_name:
                      maxLength: 1024
                      minLength: 1
                      type: string
                      description: The name of the process to terminate. Valid for SentinelOne agent type only.
                      example: Elastic
    Security_Endpoint_Management_API_Kuery:
      maxLength: 30000
      type: string
      description: A KQL string.
      example: 'united.endpoint.host.os.name : ''Windows'''
    Security_Endpoint_Management_API_MDECancelParameters:
      title: MDECancelParameters
      required:
        - id
      type: object
      properties:
        id:
          maxLength: 50
          minLength: 1
          type: string
          description: ID of the response action to cancel
          example: 7f8c9b2a-4d3e-4f5a-8b1c-2e3f4a5b6c7d
      description: Microsoft Defender for Endpoint agent type
    Security_Endpoint_Management_API_MDERunScriptParameters:
      title: Microsoft Defender Endpoint Run Script Parameters
      required:
        - scriptName
      type: object
      properties:
        args:
          maxLength: 8192
          minLength: 1
          type: string
          description: Optional command line arguments for the script.
        scriptName:
          maxLength: 256
          minLength: 1
          type: string
          description: The name of the script to execute from the cloud storage.
      description: Parameters for Run Script response action against Microsoft Defender Endpoint agent type.
      example:
        agent_type: microsoft_defender_endpoint
        endpoint_ids:
          - endpoint-id-1
        parameters:
          args: '-param1 value1 -param2 value2'
          scriptName: my-script.ps1
    Security_Endpoint_Management_API_MemoryDump:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - required:
            - parameters
          type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    title: Memory dump output
                    type: object
                    properties:
                      code:
                        type: string
                      disk_free_space:
                        type: number
                        description: The free space on the host machine in bytes after the memory dump is written to disk
                      file_size:
                        type: string
                        description: The size of the memory dump compressed file in bytes
                      path:
                        type: string
                        description: The path to the memory dump compressed file on the host machine
            parameters:
              oneOf:
                - title: Kernel memory dump
                  required:
                    - type
                  type: object
                  properties:
                    type:
                      enum:
                        - kernel
                      type: string
                      description: Kernel-level memory dump
                - title: Process memory dump with PID
                  required:
                    - type
                    - pid
                  type: object
                  properties:
                    pid:
                      type: number
                      description: The process ID (PID)
                    type:
                      enum:
                        - process
                      type: string
                      description: Process-level memory dump using a process ID
                - title: Process memory dump with entity ID
                  required:
                    - type
                    - entity_id
                  type: object
                  properties:
                    entity_id:
                      type: string
                      description: The process entity ID
                    type:
                      enum:
                        - process
                      type: string
                      description: Process-level memory dump using an entity ID
    Security_Endpoint_Management_API_MemoryDumpRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              oneOf:
                - title: kernel
                  required:
                    - type
                  type: object
                  properties:
                    type:
                      enum:
                        - kernel
                      type: string
                  description: Dump the entire kernel memory.
                - title: raw
                  required:
                    - type
                  type: object
                  properties:
                    type:
                      enum:
                        - raw
                      type: string
                  description: Dump the entire raw memory.
                - title: Process PID
                  required:
                    - type
                    - pid
                  type: object
                  properties:
                    pid:
                      type: number
                    type:
                      enum:
                        - process
                      type: string
                  description: Dump the entire memory of a process using the PID.
                - title: Process Entity ID
                  required:
                    - type
                    - entity_id
                  type: object
                  properties:
                    entity_id:
                      maxLength: 256
                      minLength: 1
                      type: string
                    type:
                      enum:
                        - process
                      type: string
                  description: Dump the entire memory of a process using the entity ID.
    Security_Endpoint_Management_API_MetadataListResponse:
      type: object
      example:
        data:
          - host_status: healthy
            last_checkin: '2023-07-04T15:47:57.432Z'
            metadata:
              '@timestamp': '2023-07-04T15:47:57.432173535Z'
              agent:
                build:
                  original: 'version: 7.16.0, compiled: Tue Nov 16 16:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
                id: 285297c6-3bff-4b83-9a07-f3e749801123
                type: endpoint
                version: '7.16.0'
              data_stream:
                dataset: endpoint.metadata
                namespace: default
                type: metrics
              ecs:
                version: '1.11.0'
              elastic:
                agent:
                  id: 285297c6-3bff-4b83-9a07-f3e749801123
              Endpoint:
                capabilities:
                  - isolation
                configuration:
                  isolation: false
                policy:
                  applied:
                    endpoint_policy_version: '2'
                    id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                    name: test
                    status: success
                    version: '3'
                state:
                  isolation: false
                status: enrolled
              event:
                action: endpoint_metadata
                agent_id_status: verified
                category:
                  - host
                created: '2023-07-04T15:47:57.432173535Z'
                dataset: endpoint.metadata
                id: MNtSXK/SkhEBnmgt++++++7S
                ingested: '2023-07-04T15:47:58Z'
                kind: metric
                module: endpoint
                sequence: 400
                type:
                  - info
              host:
                architecture: x86_64
                hostname: david-Xubuntu
                id: 0cfead88e2024bd8a27476352b5ab264
                ip:
                  - 127.0.0.1
                  - '::1'
                  - 10.0.2.15
                  - fe80::2ac7:8e15:b957:2fa1
                mac:
                  - 08:00:27:e6:78:8b
                name: david-Xubuntu
                os:
                  Ext:
                    variant: Ubuntu
                  family: ubuntu
                  full: Ubuntu 20.04.2
                  kernel: '5.8.0-59-generic #66~20.04.1-Ubuntu SMP Thu Jun 17 11:14:10 UTC 2021'
                  name: Linux
                  platform: ubuntu
                  type: linux
                  version: 20.04.2
              message: Endpoint metadata
            policy_info:
              agent:
                applied:
                  id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                  revision: 0
                configured:
                  id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                  revision: 3
              endpoint:
                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                revision: 2
          - host_status: healthy
            last_checkin: '2023-07-04T15:44:31.491Z'
            metadata:
              '@timestamp': '2023-07-04T15:44:31.4917849Z'
              agent:
                build:
                  original: 'version: 7.16.0, compiled: Tue Nov 16 17:00:00 2021, branch: 7.16, commit: 73a51033db85e0fb3be1c934697ef6a2b08979ab'
                id: abb8a826-6812-448c-a571-6d8269b51449
                type: endpoint
                version: '7.16.0'
              data_stream:
                dataset: endpoint.metadata
                namespace: default
                type: metrics
              ecs:
                version: '1.11.0'
              elastic:
                agent:
                  id: abb8a826-6812-448c-a571-6d8269b51449
              Endpoint:
                capabilities:
                  - isolation
                configuration:
                  isolation: false
                policy:
                  applied:
                    endpoint_policy_version: '2'
                    id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                    name: test
                    status: success
                    version: '3'
                state:
                  isolation: false
                status: enrolled
              event:
                action: endpoint_metadata
                agent_id_status: verified
                category:
                  - host
                created: '2023-07-04T15:44:31.4917849Z'
                dataset: endpoint.metadata
                id: MNtRc++KoKHXXwlj+++++/N9
                ingested: '2023-07-04T15:44:33Z'
                kind: metric
                module: endpoint
                sequence: 5159
                type:
                  - info
              host:
                architecture: x86_64
                hostname: WinDev2104Eval
                id: 17d9cabc-7edd-43bc-bacb-8da5f5e6c0e5
                ip:
                  - 10.0.2.15
                  - fe80::21a6:63d3:d70e:e3ad
                  - 127.0.0.1
                  - '::1'
                mac:
                  - 08:00:27:b1:1d:5a
                name: WinDev2104Eval
                os:
                  Ext:
                    variant: Windows 10 Enterprise Evaluation
                  family: windows
                  full: Windows 10 Enterprise Evaluation 20H2 (10.0.19042.906)
                  kernel: 20H2 (10.0.19042.906)
                  name: Windows
                  platform: windows
                  type: windows
                  version: 20H2 (10.0.19042.906)
              message: Endpoint metadata
            policy_info:
              agent:
                applied:
                  id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                  revision: 0
                configured:
                  id: ed7e3720-4bad-11ec-a2a8-fb22e62a5753
                  revision: 3
              endpoint:
                id: d5371dcd-93b7-4627-af88-4084f7d6aa3e
                revision: 2
        page: 0
        pageSize: 10
        sortDirection: desc
        sortField: enrolled_at
        total: 2
    Security_Endpoint_Management_API_Page:
      minimum: 1
      type: integer
      description: Page number
      default: 1
      example: 1
    Security_Endpoint_Management_API_PageSize:
      maximum: 100
      minimum: 1
      type: integer
      description: Number of items per page
      default: 10
      example: 10
    Security_Endpoint_Management_API_Parameters:
      type: object
      description: Parameters object
    Security_Endpoint_Management_API_PatchUpdateScriptRouteRequestBody:
      minProperties: 1
      type: object
      properties:
        description:
          maxLength: 10000
          type: string
          description: Description of the script and its purpose/functionality
        example:
          maxLength: 10000
          type: string
          description: Example usage of the script
        file:
          type: object
          description: The script file upload
          format: binary
        fileType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptFileType'
        instructions:
          maxLength: 10000
          type: string
          description: 'Instructions for using the script, including details around its supported input arguments'
        name:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ScriptNameSchema'
        pathToExecutable:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ArchivePathToExecutableSchema'
        platform:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptPlatform'
          description: Platforms supported by the the script
        requiresInput:
          type: boolean
          description: Whether the script requires input arguments
        tags:
          type: array
          items:
            $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScriptTags'
          description: Tags to categorize the script
        version:
          maxLength: 256
          minLength: 1
          type: string
          description: Version of the script
      description: The script entry properties to be updated. At least one property must be provided.
    Security_Endpoint_Management_API_PendingActionDataType:
      type: integer
      description: Number of pending actions of this type.
    Security_Endpoint_Management_API_PendingActionsSchema:
      oneOf:
        - type: object
          properties:
            execute:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            get-file:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            isolate:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            kill-process:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            running-processes:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            scan:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            suspend-process:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            unisolate:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
            upload:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_PendingActionDataType'
        - type: object
    Security_Endpoint_Management_API_ProtectionUpdatesNoteResponse:
      type: object
      properties:
        note:
          type: string
          description: A note associated with the protection updates for the given package policy.
    Security_Endpoint_Management_API_RawScriptParameters:
      required:
        - raw
      type: object
      properties:
        commandLine:
          maxLength: 8192
          minLength: 1
          type: string
          description: Command line arguments.
        raw:
          maxLength: 65536
          minLength: 1
          type: string
          description: Raw script content.
        timeout:
          minimum: 1
          type: integer
          description: Timeout in seconds.
    Security_Endpoint_Management_API_ResponseActionCreateSuccessResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
      example:
        data:
          agents:
            - ed518850-681a-4d60-bb98-e22640cae2a8
          agentState:
            ed518850-681a-4d60-bb98-e22640cae2a8:
              isCompleted: false
              wasSuccessful: false
          agentType: __agent__type__here_
          command: __command__name__here__
          createdBy: elastic
          hosts:
            ed518850-681a-4d60-bb98-e22640cae2a8:
              name: gke-node-1235412
          id: 233db9ea-6733-4849-9226-5a7039c7161d
          isCompleted: false
          isExpired: false
          outputs: { }
          parameters: { }
          startedAt: '2022-07-29T19:08:49.126Z'
          status: pending
          wasSuccessful: false
    Security_Endpoint_Management_API_ResponseActionDetails:
      required:
        - command
      type: object
      properties:
        agents:
          type: array
          items:
            type: string
            format: uuid
          description: The agent IDs for the hosts that the response action was sent to
        agentState:
          type: object
          additionalProperties:
            type: object
            properties:
              completedAt:
                type: string
                description: The date and time the response action was completed for the agent ID
              isCompleted:
                type: boolean
                description: Whether the response action is completed for the agent ID
              wasCanceled:
                type: boolean
                description: Whether the response action was canceled for the agent ID
              wasSuccessful:
                type: boolean
                description: Whether the response action was successful for the agent ID
            format: uuid
          description: The state of the response action for each agent ID that it was sent to
        agentType:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
        command:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_Command'
        completedAt:
          type: string
          description: The response action completion time
          format: date-time
        createdBy:
          type: string
          description: The user who created the response action
        hosts:
          type: object
          additionalProperties:
            type: object
            properties:
              name:
                type: string
                description: The host name
            format: uuid
          description: An object containing the host names associated with the agent IDs the response action was sent to
        id:
          type: string
          description: The response action ID
          format: uuid
        isComplete:
          type: boolean
          description: Whether the response action is complete
        isExpired:
          type: boolean
          description: Whether the response action is expired
        outputs:
          type: object
          additionalProperties:
            title: Agent ID
            required:
              - type
              - content
            type: object
            properties:
              content:
                type:
                  - string
                  - object
                description: The response action output content for the agent ID. Exact format depends on the response action command.
              type:
                enum:
                  - json
                  - text
                type: string
            description: The agent id
            format: uuid
          description: "The outputs of the response action for each agent ID that it was sent to. Content different depending on the\nresponse action command and will only be present for agents that have responded to the response action\n"
        parameters:
          type: object
          description: The parameters of the response action. Content different depending on the response action command
        startedAt:
          type: string
          description: The response action start time
          format: date-time
        status:
          type: string
          description: The response action status
        wasCanceled:
          type: boolean
          description: Whether the response action was canceled
        wasSuccessful:
          type: boolean
          description: Whether the response action was successful
    Security_Endpoint_Management_API_RunningProcesses:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    oneOf:
                      - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputEndpoint'
                      - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne'
    Security_Endpoint_Management_API_RunningProcessesOutputEndpoint:
      type: object
      properties:
        code:
          type: string
        entries:
          type: array
          items:
            type: object
            properties:
              command:
                type: string
              entity_id:
                type: string
              pid:
                type: number
              user:
                type: string
      description: Processes output for `agentType` of `endpoint`
    Security_Endpoint_Management_API_RunningProcessesOutputSentinelOne:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
        - type: object
          properties:
            code:
              type: string
          description: Processes output for `agentType` of `sentinel_one`
    Security_Endpoint_Management_API_Runscript:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    allOf:
                      - $ref: '#/components/schemas/Security_Endpoint_Management_API_DownloadUri'
                      - type: object
                        properties:
                          code:
                            type: string
                          stderr:
                            type: string
                          stdout:
                            type: string
            parameters:
              oneOf:
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsCrowdStrike'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsMicrosoft'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_RunscriptParamsSentinelOne'
    Security_Endpoint_Management_API_RunscriptParamsCrowdStrike:
      type: object
      properties:
        cloudFile:
          type: string
        commandLine:
          type: string
        hostPath:
          type: string
        raw:
          type: string
        timeout:
          type: number
    Security_Endpoint_Management_API_RunscriptParamsMicrosoft:
      type: object
      properties:
        args:
          type: string
        scriptName:
          type: string
    Security_Endpoint_Management_API_RunscriptParamsSentinelOne:
      type: object
      properties:
        scriptId:
          type: string
        scriptInput:
          type: string
    Security_Endpoint_Management_API_RunScriptRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              oneOf:
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointRunScriptParameters'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_RawScriptParameters'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_HostPathScriptParameters'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_CloudFileScriptParameters'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_SentinelOneRunScriptParameters'
                - $ref: '#/components/schemas/Security_Endpoint_Management_API_MDERunScriptParameters'
              description: "One of the following set of parameters must be provided for the `agentType` that is specified.\n"
    Security_Endpoint_Management_API_Scan:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    type: object
                    properties:
                      code:
                        type: string
            parameters:
              type: object
              properties:
                path:
                  type: string
    Security_Endpoint_Management_API_ScanRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              required:
                - path
              type: object
              properties:
                path:
                  maxLength: 4096
                  minLength: 1
                  type: string
                  description: The folder or file's full path (including the file name).
                  example: /usr/my-file.txt
    Security_Endpoint_Management_API_ScriptNameSchema:
      maxLength: 256
      minLength: 1
      type: string
      description: Name of the script
    Security_Endpoint_Management_API_ScriptsApiResponse:
      type: object
      properties:
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointScript'
      example:
        data:
          description: Collects host data for investigation
          downloadUri: /api/endpoint/scripts_library/123e4567-e89b-12d3-a456-426655440000/download
          example: ./collect_host_data.sh --help
          fileHash: abf573681eb54aac5e05e35bf186d4d31abe45ecf242461490523f11d2a8fbb8
          fileName: collect_host_data.sh
          fileSize: 12345
          id: 123e4567-e89b-12d3-a456-426655440000
          instructions: Collects host data for investigation
          name: Collect host data
          platform:
            - linux
            - macos
          requiresInput: false
    Security_Endpoint_Management_API_SentinelOneRunScriptParameters:
      title: SentinelOne Run Script Parameters
      required:
        - scriptId
      type: object
      properties:
        scriptId:
          maxLength: 256
          minLength: 1
          type: string
          description: The script ID from SentinelOne scripts library that will be executed.
        scriptInput:
          maxLength: 8192
          minLength: 1
          type: string
          description: The input parameter arguments for the script that was selected.
      description: Parameters for Run Script response action against SentinelOne agent type.
      example:
        agent_type: sentinel_one
        endpoint_ids:
          - endpoint-id-1
        parameters:
          scriptId: 1111-2222-3333-4444-5555-6666-7777-8888
          scriptInput: '--delete --paths-to-delete /tmp/temp_file.txt,/tmp/random_file.txt'
    Security_Endpoint_Management_API_SortDirection:
      enum:
        - asc
        - desc
      type: string
      description: Determines the sort order.
      example: desc
    Security_Endpoint_Management_API_SortField:
      enum:
        - enrolled_at
        - metadata.host.hostname
        - host_status
        - metadata.Endpoint.policy.applied.name
        - metadata.Endpoint.policy.applied.status
        - metadata.host.os.name
        - metadata.host.ip
        - metadata.agent.version
        - last_checkin
      type: string
      description: Determines which field is used to sort the results.
      example: enrolled_at
    Security_Endpoint_Management_API_StartDate:
      maxLength: 64
      type: string
      description: A start date in ISO 8601 format or Date Math format.
      example: '2023-10-31T00:00:00.000Z'
    Security_Endpoint_Management_API_SuccessResponse:
      type: object
      description: A generic successful response.
    Security_Endpoint_Management_API_SuspendProcess:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    oneOf:
                      - type: object
                        properties:
                          code:
                            type: string
                          command:
                            type: string
                          pid:
                            type: number
                      - type: object
                        properties:
                          code:
                            type: string
                          command:
                            type: string
                          entity_id:
                            type: string
            parameters:
              oneOf:
                - type: object
                  properties:
                    pid:
                      minimum: 1
                      type: number
                      description: The process ID (PID) of the process to terminate.
                - type: object
                  properties:
                    entity_id:
                      minLength: 1
                      type: string
                      description: The entity ID of the process to terminate.
    Security_Endpoint_Management_API_SuspendProcessRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
          type: object
          properties:
            parameters:
              oneOf:
                - type: object
                  properties:
                    pid:
                      minimum: 1
                      type: integer
                      description: The process ID (PID) of the process to suspend.
                      example: 123
                - type: object
                  properties:
                    entity_id:
                      maxLength: 256
                      minLength: 1
                      type: string
                      description: The entity ID of the process to suspend.
                      example: abc123
    Security_Endpoint_Management_API_Type:
      enum:
        - automated
        - manual
      type: string
      description: Type of response action
    Security_Endpoint_Management_API_Types:
      maxLength: 2
      minLength: 1
      type: array
      items:
        $ref: '#/components/schemas/Security_Endpoint_Management_API_Type'
      description: List of types of response actions
      example:
        - automated
        - manual
    Security_Endpoint_Management_API_Unisolate:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          description: Details of an unisolate action response.
    Security_Endpoint_Management_API_UnisolateRouteResponse:
      type: object
      properties:
        action:
          type: string
          description: 'The action ID (legacy field, same as `data.id`).'
        data:
          $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
    Security_Endpoint_Management_API_Upload:
      allOf:
        - $ref: '#/components/schemas/Security_Endpoint_Management_API_ResponseActionDetails'
        - type: object
          properties:
            outputs:
              type: object
              additionalProperties:
                type: object
                properties:
                  content:
                    type: object
                    properties:
                      code:
                        type: string
                      disk_free_space:
                        type: number
                      path:
                        type: string
            parameters:
              type: object
              properties:
                file_id:
                  type: string
                file_name:
                  type: string
                file_sha256:
                  type: string
                file_size:
                  type: number
              description: "The parameters for upload returned on the details are derived via the API from the file that\nwas uploaded at the time that the response action was submitted\n"
    Security_Endpoint_Management_API_UploadRouteRequestBody:
      allOf:
        - required:
            - endpoint_ids
          type: object
          properties:
            agent_type:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_AgentTypes'
            alert_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: 'If this action is associated with any alerts, they can be specified here. The action will be logged in any cases associated with the specified alerts. Max of 50.'
              example:
                - alert-id-1
                - alert-id-2
            case_ids:
              maxItems: 50
              minItems: 1
              type: array
              items:
                maxLength: 256
                minLength: 1
                type: string
              description: The IDs of cases where the action taken will be logged. Max of 50.
              example:
                - case-id-1
                - case-id-2
            comment:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Comment'
            endpoint_ids:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_EndpointIds'
            parameters:
              $ref: '#/components/schemas/Security_Endpoint_Management_API_Parameters'
        - required:
            - parameters
            - file
          type: object
          properties:
            file:
              type: string
              description: The binary content of the file.
              format: binary
              example: RWxhc3RpYw==
            parameters:
              type: object
              properties:
                overwrite:
                  type: boolean
                  description: Overwrite the file on the host if it already exists.
                  default: false
                  example: false
    Security_Endpoint_Management_API_UserIds:
      oneOf:
        - maxItems: 50
          minItems: 1
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
        - maxLength: 256
          minLength: 1
          type: string
      description: A list of user IDs. Max of 50.
      example:
        - user-id-1
        - user-id-2
    Security_Endpoint_Management_API_WithOutputs:
      oneOf:
        - maxItems: 50
          minItems: 1
          type: array
          items:
            maxLength: 256
            minLength: 1
            type: string
        - maxLength: 256
          minLength: 1
          type: string
      description: A list of action IDs that should include the complete output of the action. Max of 50.
      example:
        - action-id-1
        - action-id-2
    Security_Entity_Analytics_API_AssetCriticalityBulkUploadErrorItem:
      required:
        - message
        - index
      type: object
      properties:
        index:
          type: integer
        message:
          type: string
    Security_Entity_Analytics_API_AssetCriticalityBulkUploadStats:
      required:
        - successful
        - failed
        - total
      type: object
      properties:
        failed:
          type: integer
        successful:
          type: integer
        total:
          type: integer
    Security_Entity_Analytics_API_AssetCriticalityLevel:
      enum:
        - low_impact
        - medium_impact
        - high_impact
        - extreme_impact
      type: string
      description: The criticality level of the asset.
    Security_Entity_Analytics_API_AssetCriticalityLevelsForBulkUpload:
      enum:
        - low_impact
        - medium_impact
        - high_impact
        - extreme_impact
        - unassigned
      type: string
      description: The criticality level of the asset for bulk upload. The value `unassigned` is used to indicate that the criticality level is not assigned and is only used for bulk upload.
    Security_Entity_Analytics_API_AssetCriticalityRecord:
      allOf:
        - $ref: '#/components/schemas/Security_Entity_Analytics_API_CreateAssetCriticalityRecord'
        - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts'
        - required:
            - '@timestamp'
          type: object
          properties:
            '@timestamp':
              type: string
              description: The time the record was created or updated.
              format: date-time
              example: '2017-07-21T17:32:28Z'
      example:
        '@timestamp': '2024-08-02T11:15:34.290Z'
        asset:
          criticality: high_impact
        criticality_level: high_impact
        host:
          asset:
            criticality: high_impact
          name: my_host
        id_field: host.name
        id_value: my_host
    Security_Entity_Analytics_API_AssetCriticalityRecordEcsParts:
      required:
        - asset
      type: object
      properties:
        asset:
          required:
            - asset
          type: object
          properties:
            criticality:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
        entity:
          required:
            - id
          type: object
          properties:
            asset:
              required:
                - criticality
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
            id:
              type: string
        host:
          required:
            - name
          type: object
          properties:
            asset:
              required:
                - criticality
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
            name:
              type: string
        service:
          required:
            - name
          type: object
          properties:
            asset:
              required:
                - criticality
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
            name:
              type: string
        user:
          required:
            - name
          type: object
          properties:
            asset:
              required:
                - criticality
              type: object
              properties:
                criticality:
                  $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
            name:
              type: string
    Security_Entity_Analytics_API_AssetCriticalityRecordIdParts:
      required:
        - id_value
        - id_field
      type: object
      properties:
        id_field:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdField'
        id_value:
          type: string
          description: The ID value of the asset.
    Security_Entity_Analytics_API_CleanUpRiskEngineErrorResponse:
      required:
        - cleanup_successful
        - errors
      type: object
      properties:
        cleanup_successful:
          type: boolean
          example: false
        errors:
          type: array
          items:
            required:
              - seq
              - error
            type: object
            properties:
              error:
                type: string
              seq:
                type: integer
    Security_Entity_Analytics_API_ConfigureRiskEngineSavedObjectErrorResponse:
      required:
        - risk_engine_saved_object_configured
        - errors
      type: object
      properties:
        errors:
          type: array
          items:
            required:
              - seq
              - error
            type: object
            properties:
              error:
                type: string
              seq:
                type: integer
        risk_engine_saved_object_configured:
          type: boolean
          example: false
    Security_Entity_Analytics_API_CreateAssetCriticalityRecord:
      allOf:
        - $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityRecordIdParts'
        - required:
            - criticality_level
          type: object
          properties:
            criticality_level:
              $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
    Security_Entity_Analytics_API_DateRange:
      required:
        - start
        - end
      type: object
      properties:
        end:
          maxLength: 256
          type: string
          description: 'End of the lookback period (date math or ISO string, e.g. "now")'
        start:
          maxLength: 256
          type: string
          description: 'Start of the lookback period (date math or ISO string, e.g. "now-10d")'
      description: Defines the lookback period for filtering source data by timestamp.
    Security_Entity_Analytics_API_EntityAnalyticsPrivileges:
      required:
        - has_all_required
        - privileges
      type: object
      properties:
        has_all_required:
          type: boolean
        has_install_permissions:
          type: boolean
        has_read_permissions:
          type: boolean
        has_write_permissions:
          type: boolean
        install_privileges:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail'
        privileges:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail'
    Security_Entity_Analytics_API_EntityAnalyticsPrivilegesDetail:
      required:
        - elasticsearch
      type: object
      properties:
        elasticsearch:
          type: object
          properties:
            cluster:
              type: object
              additionalProperties:
                type: boolean
            index:
              type: object
              additionalProperties:
                type: object
                additionalProperties:
                  type: boolean
        kibana:
          type: object
          additionalProperties:
            type: boolean
    Security_Entity_Analytics_API_EntityRiskLevels:
      enum:
        - Unknown
        - Low
        - Moderate
        - High
        - Critical
      type: string
    Security_Entity_Analytics_API_EntitySourceType:
      enum:
        - index
        - entity_analytics_integration
        - store
      type: string
    Security_Entity_Analytics_API_Filter:
      type: object
      properties:
        kuery:
          oneOf:
            - maxLength: 4096
              type: string
            - type: object
              additionalProperties: false
    Security_Entity_Analytics_API_IdentifierType:
      enum:
        - host
        - user
        - service
        - generic
      type: string
    Security_Entity_Analytics_API_IdField:
      enum:
        - host.name
        - user.name
        - service.name
        - entity.id
      type: string
    Security_Entity_Analytics_API_Integrations:
      type: object
      properties:
        syncData:
          type: object
          properties:
            lastFullSync:
              type: string
              description: Timestamp of the last full sync from integrations
              format: date-time
            lastUpdateProcessed:
              type: string
              description: Timestamp of the last update processed from integrations
              format: date-time
          description: integrations latest full sync and update syncData
        syncMarkerIndex:
          maxLength: 1000
          type: string
          description: Index to read latest sync markers from
    Security_Entity_Analytics_API_Matcher:
      required:
        - fields
        - values
      type: object
      properties:
        fields:
          maxItems: 100
          type: array
          items:
            maxLength: 256
            type: string
        values:
          oneOf:
            - maxItems: 1000
              type: array
              items:
                maxLength: 256
                type: string
            - maxItems: 1000
              type: array
              items:
                type: boolean
          description: "Matcher values. Must be either an array of strings (e.g. group or role names) or an array of booleans (e.g. integration-derived flags like privileged_group_member). Mixed types are intentionally not supported for simplicity and predictability.\n"
    Security_Entity_Analytics_API_MonitoredUserDoc:
      allOf:
        - $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoredUserUpdateDoc'
        - type: object
          properties:
            '@timestamp':
              type: string
              format: date-time
            event:
              type: object
              properties:
                '@timestamp':
                  type: string
                  format: date-time
                ingested:
                  type: string
                  format: date-time
            user:
              type: object
              properties:
                entity:
                  type: object
                  properties:
                    attributes:
                      type: object
                      properties:
                        Privileged:
                          type: boolean
                          description: Indicates if the user is privileged.
                is_privileged:
                  type: boolean
                  description: Indicates if the user is privileged.
                name:
                  type: string
    Security_Entity_Analytics_API_MonitoredUserUpdateDoc:
      type: object
      properties:
        entity_analytics_monitoring:
          type: object
          properties:
            labels:
              type: array
              items:
                $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringLabel'
        id:
          maxLength: 256
          type: string
        labels:
          type: object
          properties:
            source_ids:
              maxItems: 100
              type: array
              items:
                maxLength: 256
                type: string
            source_integrations:
              maxItems: 100
              type: array
              items:
                maxLength: 256
                type: string
            sources:
              maxItems: 100
              type: array
              items:
                enum:
                  - csv
                  - index_sync
                  - api
        user:
          type: object
          properties:
            is_privileged:
              type: boolean
              description: Indicates if the user is privileged.
            name:
              maxLength: 512
              type: string
    Security_Entity_Analytics_API_MonitoringEngineDescriptor:
      required:
        - status
      type: object
      properties:
        error:
          type: object
          properties:
            message:
              type: string
              description: Error message typically only present if the engine is in error state
        status:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus'
    Security_Entity_Analytics_API_MonitoringEntitySource:
      allOf:
        - $ref: '#/components/schemas/Security_Entity_Analytics_API_MonitoringEntitySourceProperties'
        - required:
            - type
            - name
            - id
            - managed
          type: object
          properties:
            apiKeyId:
              maxLength: 64
              type:
                - 'null'
                - string
              description: ID of the API key used for scoped reads from the source index. Only present for index-type sources.
            id:
              type: string
    Security_Entity_Analytics_API_MonitoringEntitySourceProperties:
      allOf:
        - $ref: '#/components/schemas/Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties'
        - type: object
          properties:
            managed:
              type: boolean
    Security_Entity_Analytics_API_MonitoringLabel:
      required:
        - field
        - value
        - source
      type: object
      properties:
        field:
          maxLength: 256
          type: string
        source:
          type: string
        value:
          maxLength: 256
          type: string
    Security_Entity_Analytics_API_PrivilegeMonitoringEngineStatus:
      enum:
        - started
        - error
        - disabled
        - not_installed
      type: string
      description: The status of the Privilege Monitoring Engine
    Security_Entity_Analytics_API_PrivmonUserCsvUploadErrorItem:
      required:
        - message
        - index
        - username
      type: object
      properties:
        index:
          type:
            - 'null'
            - integer
        message:
          type: string
        username:
          type:
            - 'null'
            - string
    Security_Entity_Analytics_API_PrivmonUserCsvUploadStats:
      required:
        - successfulOperations
        - uploaded
        - failedOperations
        - totalOperations
      type: object
      properties:
        failedOperations:
          type: integer
        successfulOperations:
          type: integer
        totalOperations:
          type: integer
        uploaded:
          type: integer
    Security_Entity_Analytics_API_RiskEngineScheduleNowErrorResponse:
      required:
        - message
        - full_error
      type: object
      properties:
        full_error:
          type: string
        message:
          type: string
    Security_Entity_Analytics_API_RiskEngineScheduleNowResponse:
      type: object
      properties:
        success:
          type: boolean
    Security_Entity_Analytics_API_RiskScoreHistoryEntry:
      required:
        - '@timestamp'
        - calculated_score_norm
        - calculated_level
      type: object
      properties:
        '@timestamp':
          maxLength: 33
          type: string
          format: date-time
        calculated_level:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntityRiskLevels'
        calculated_score:
          type: number
          format: double
        calculated_score_norm:
          maximum: 100
          minimum: 0
          type: number
          format: double
        category_1_count:
          type: integer
        category_1_score:
          type: number
          format: double
        category_2_count:
          type: integer
        category_2_score:
          type: number
          format: double
        criticality_level:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_AssetCriticalityLevel'
        inputs:
          type: array
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreInput'
          description: Present only when requested with `include_contributions=true`.
        modifiers:
          type: array
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreModifier'
          description: Present only when requested with `include_contributions=true`.
        score_type:
          enum:
            - base
            - propagated
            - resolution
          type: string
    Security_Entity_Analytics_API_RiskScoreHistoryResponse:
      required:
        - entity_id
        - entity_type
        - interval
        - entries
      type: object
      properties:
        entity_id:
          maxLength: 1000
          type: string
        entity_type:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_IdentifierType'
        entries:
          type: array
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_RiskScoreHistoryEntry'
        interval:
          maxLength: 10
          type: string
          description: 'The effective Elasticsearch `date_histogram` interval expression the entries were aggregated into (for example `3h`, `1d`, `1w`), derived from the requested time range.'
    Security_Entity_Analytics_API_RiskScoreInput:
      required:
        - id
        - index
        - description
        - category
      type: object
      properties:
        category:
          type: string
          description: The risk category of the risk input document.
          example: category_1
        contribution_score:
          type: number
          format: double
        description:
          type: string
          description: A human-readable description of the risk input document.
          example: 'Generated from Detection Engine Rule: Malware Prevention Alert'
        entity_id:
          type: string
          description: The EUID of the entity within the graph that generated this alert.
        id:
          type: string
          description: The unique identifier (`_id`) of the original source document
          example: 91a93376a507e86cfbf282166275b89f9dbdb1f0be6c8103c6ff2909ca8e1a1c
        index:
          type: string
          description: The unique index (`_index`) of the original source document
          example: .internal.alerts-security.alerts-default-000001
        risk_score:
          maximum: 100
          minimum: 0
          type: number
          description: The weighted risk score of the risk input document.
          format: double
        timestamp:
          type: string
          description: The @timestamp of the risk input document.
          example: '2017-07-21T17:32:28Z'
      description: A generic representation of a document contributing to a Risk Score.
    Security_Entity_Analytics_API_RiskScoreModifier:
      required:
        - type
        - contribution
      type: object
      properties:
        contribution:
          type: number
          format: double
        metadata:
          type: object
        modifier_value:
          type: number
          format: double
        subtype:
          maxLength: 100
          type: string
        type:
          maxLength: 100
          type: string
      description: A modifier that was applied to the risk score calculation.
    Security_Entity_Analytics_API_TaskManagerUnavailableResponse:
      required:
        - status_code
        - message
      type: object
      properties:
        message:
          type: string
        status_code:
          minimum: 400
          type: integer
      description: Task manager is unavailable
    Security_Entity_Analytics_API_UpdateableMonitoringEntitySourceProperties:
      type: object
      properties:
        enabled:
          type: boolean
        filter:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_Filter'
        identifierField:
          maxLength: 256
          type: string
          description: Field used to query the entity store for index-type sources
        indexPattern:
          maxLength: 1000
          type: string
        integrationName:
          maxLength: 256
          type: string
        integrations:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_Integrations'
        matchers:
          maxItems: 100
          type: array
          items:
            $ref: '#/components/schemas/Security_Entity_Analytics_API_Matcher'
        name:
          maxLength: 256
          type: string
        queryRule:
          maxLength: 4096
          type: string
          description: KQL query used to filter data from the provided index patterns
        range:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_DateRange'
        type:
          $ref: '#/components/schemas/Security_Entity_Analytics_API_EntitySourceType'
    Security_Entity_Analytics_API_UserName:
      type: object
      properties:
        entity_analytics_monitoring:
          type: object
          properties:
            labels:
              maxItems: 100
              type: array
              items:
                type: object
                properties:
                  field:
                    maxLength: 256
                    type: string
                    description: The field name for the label
                  source:
                    enum:
                      - api
                      - csv
                      - index_sync
                    type: string
                    description: 'The source where this label was created (api, csv, or index_sync)'
                  value:
                    maxLength: 256
                    type: string
                    description: The value of the label
              description: Array of labels associated with the user
          description: Entity analytics monitoring configuration for the user
        user:
          type: object
          properties:
            name:
              maxLength: 512
              type: string
              description: The name of the user.
    Security_Entity_Analytics_API_WatchlistCsvUploadResponseItem:
      required:
        - status
        - matchedEntities
      type: object
      properties:
        error:
          type: string
          description: Error message if the row failed to process
          example: Invalid entity type
        matchedEntities:
          type: integer
          description: Number of entities matched for this row
          example: 1
        status:
          enum:
            - success
            - failure
            - unmatched
          type: string
          example: success
      example:
        matchedEntities: 1
        status: success
    Security_Entity_Analytics_API_WatchlistEntityAssignResponseItem:
      required:
        - euid
        - status
      type: object
      properties:
        error:
          type: string
          description: Error message if the entity failed to process
          example: Invalid entity type
        euid:
          type: string
          description: The EUID of the entity
          example: user:john.doe
        status:
          enum:
            - success
            - failure
            - not_found
          type: string
          example: success
      example:
        euid: user:john.doe
        status: success
    Security_Entity_Analytics_API_WatchlistEntityUnassignResponseItem:
      required:
        - euid
        - status
      type: object
      properties:
        error:
          type: string
          description: Error message if the entity failed to process
          example: Invalid entity type
        euid:
          type: string
          description: The EUID of the entity
          example: user:john.doe
        status:
          enum:
            - success
            - failure
            - not_found
          type: string
          example: success
      example:
        euid: user:john.doe
        status: success
    Security_Entity_Analytics_API_WatchlistObject:
      required:
        - name
        - riskModifier
        - managed
      type: object
      properties:
        createdAt:
          type: string
          description: Timestamp indicating when the watchlist was created
          format: date-time
        description:
          type: string
          description: Description of the watchlist
        entityCount:
          type: number
          description: Number of entities in the watchlist
        entitySourceIds:
          type: array
          items:
            type: string
          description: List of entity source IDs associated with the watchlist
        hasManualEntities:
          type: boolean
          description: Indicates whether the watchlist contains manually assigned entities
        id:
          type: string
          description: The unique ID of the watchlist
        managed:
          type: boolean
          description: Indicates if the watchlist is managed by the system
        name:
          type: string
          description: The name of the watchlist
        riskModifier:
          type: number
          description: Risk score modifier associated with the watchlist
        updatedAt:
          type: string
          description: Timestamp indicating when the watchlist was last updated
          format: date-time
      example:
        createdAt: '2026-01-28T12:00:00.000Z'
        description: High risk vendor watchlist
        id: watchlist-123
        managed: false
        name: High Risk Vendors
        riskModifier: 1.5
        updatedAt: '2026-02-18T12:00:00.000Z'
    Security_Exceptions_API_BlocklistHashOrPathEntry:
      required:
        - field
        - type
        - value
        - operator
      type: object
      properties:
        field:
          enum:
            - file.hash.md5
            - file.hash.sha1
            - file.hash.sha256
            - file.path
            - file.path.caseless
          type: string
          description: File hash or path field
        operator:
          enum:
            - included
          type: string
          description: Must be the value "included"
        type:
          enum:
            - match_any
          type: string
          description: Must be match_any for blocklists
        value:
          minItems: 1
          type: array
          items:
            type: string
          description: Array of hash values or file paths
    Security_Exceptions_API_BlocklistLinuxProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry'
          description: "**Validation rules:**\n* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)\n* Path entry: only 1 allowed\n"
        list_id:
          enum:
            - endpoint_blocklists
          type: string
          example: endpoint_blocklists
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - linux
            type: string
          description: Linux-only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: 'Blocklist list item properties (Linux, code signature not supported).'
    Security_Exceptions_API_BlocklistMacProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry'
          description: "**Validation rules:**\n* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)\n* Path entry: only 1 allowed\n"
        list_id:
          enum:
            - endpoint_blocklists
          type: string
          example: endpoint_blocklists
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - macos
            type: string
          description: macOS-only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: 'Blocklist list item properties (macOS, code signature not supported).'
    Security_Exceptions_API_BlocklistWindowsCodeSignatureEntry:
      required:
        - field
        - type
        - entries
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            required:
              - field
              - type
              - value
              - operator
            type: object
            properties:
              field:
                enum:
                  - subject_name
                type: string
                description: Certificate subject name
              operator:
                enum:
                  - included
                type: string
                description: Must be the value "included"
              type:
                enum:
                  - match
                  - match_any
                type: string
                description: Match type for subject name
              value:
                oneOf:
                  - type: string
                    description: Single subject name (used with match)
                  - minItems: 1
                    type: array
                    items:
                      type: string
                    description: Array of subject names (used with match_any)
          description: Nested subject_name entries
        field:
          enum:
            - file.Ext.code_signature
          type: string
          description: Windows code signature field
        type:
          enum:
            - nested
          type: string
          description: Must be nested for Windows code signature
    Security_Exceptions_API_BlocklistWindowsProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistHashOrPathEntry'
              - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistWindowsCodeSignatureEntry'
          description: "**Validation rules:**\n* Hash entries: up to 3 (one for each hash type: md5, sha1, sha256)\n* Path entry: only 1 allowed\n* Code signature entry: only 1 allowed\n"
        list_id:
          enum:
            - endpoint_blocklists
          type: string
          example: endpoint_blocklists
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - windows
            type: string
          description: Windows-only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: 'Blocklist list item properties (Windows, supports code signature).'
    Security_Exceptions_API_CreateExceptionListItemBase:
      required:
        - type
        - name
        - description
      type: object
      properties:
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemCommentArray'
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        expire_time:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
    Security_Exceptions_API_CreateExceptionListItemBlocklistLinux:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistLinuxProperties'
    Security_Exceptions_API_CreateExceptionListItemBlocklistMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistMacProperties'
    Security_Exceptions_API_CreateExceptionListItemBlocklistWindows:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistWindowsProperties'
    Security_Exceptions_API_CreateExceptionListItemComment:
      required:
        - comment
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_CreateExceptionListItemCommentArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemComment'
    Security_Exceptions_API_CreateExceptionListItemEndpointList:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_EndpointListProperties'
    Security_Exceptions_API_CreateExceptionListItemEventFilters:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_EventFiltersProperties'
    Security_Exceptions_API_CreateExceptionListItemGeneric:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - required:
            - list_id
            - entries
          type: object
          properties:
            entries:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
            list_id:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
            os_types:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
            tags:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
          example:
            description: This is a sample detection type exception item.
            entries:
              - field: actingProcess.file.signer
                operator: excluded
                type: exists
              - field: host.name
                operator: included
                type: match_any
                value:
                  - saturn
                  - jupiter
            item_id: simple_list_item
            list_id: simple_list
            name: Sample Exception List Item
            namespace_type: single
            os_types:
              - linux
            tags:
              - malware
            type: simple
    Security_Exceptions_API_CreateExceptionListItemHostIsolation:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_HostIsolationProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedAppsLinux:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsLinuxProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedAppsMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsMacProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedAppsWindows:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsWindowsProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedDevicesMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesMacProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindows:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsProperties'
    Security_Exceptions_API_CreateExceptionListItemTrustedDevicesWindowsMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_CreateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsMacProperties'
    Security_Exceptions_API_CreateRuleExceptionListItemComment:
      required:
        - comment
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_CreateRuleExceptionListItemCommentArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemComment'
    Security_Exceptions_API_CreateRuleExceptionListItemProps:
      required:
        - type
        - name
        - description
        - entries
      type: object
      properties:
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_CreateRuleExceptionListItemCommentArray'
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
        expire_time:
          type: string
          format: date-time
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
    Security_Exceptions_API_EndpointArtifactTags:
      type: array
      items:
        type: string
      description: "Tags for categorization. Special tags for scope control:\n* `\"policy:all\"` - Global artifact (applies to all Elastic Defend policies)\n* `\"policy:<policy_id>\"` - Private artifact (applies to specific Elastic Defend policy only, where `<policy_id>` is the Elastic Defend integration policy ID)\n"
      default: [ ]
    Security_Exceptions_API_EndpointListProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
        list_id:
          enum:
            - endpoint_list
          type: string
          example: endpoint_list
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: Elastic Endpoint exception list item properties.
    Security_Exceptions_API_EventFiltersProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
        list_id:
          enum:
            - endpoint_event_filters
          type: string
          example: endpoint_event_filters
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: Event filters list item properties.
    Security_Exceptions_API_ExceptionList:
      required:
        - id
        - list_id
        - type
        - name
        - description
        - immutable
        - namespace_type
        - version
        - tie_breaker_id
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        _version:
          type: string
          description: 'The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
        created_by:
          type: string
          description: Autogenerated value - user that created object.
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListDescription'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        immutable:
          type: boolean
        list_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListTags'
        tie_breaker_id:
          type: string
          description: Field used in search to ensure all containers are sorted and returned correctly.
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListType'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
        updated_by:
          type: string
          description: Autogenerated value - user that last updated object.
        version:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListVersion'
    Security_Exceptions_API_ExceptionListDescription:
      type: string
      description: Describes the exception list.
      example: This list tracks allowlisted values.
    Security_Exceptions_API_ExceptionListHumanId:
      minLength: 1
      type: string
      description: "The exception list's human-readable string identifier.\n\nFor endpoint artifacts, use one of the following values:\n\n* `endpoint_list`: Elastic Endpoint exceptions list\n* `endpoint_trusted_apps`: Trusted applications list\n* `endpoint_trusted_devices`: Trusted devices list\n* `endpoint_event_filters`: Event filters list\n* `endpoint_host_isolation_exceptions`: Host isolation exceptions list\n* `endpoint_blocklists`: Blocklist\n"
      format: nonempty
      example: simple_list
    Security_Exceptions_API_ExceptionListId:
      minLength: 1
      type: string
      description: Exception list's identifier.
      format: nonempty
      example: 9e5fc75a-a3da-46c5-96e3-a2ec59c6bb85
    Security_Exceptions_API_ExceptionListItem:
      required:
        - id
        - item_id
        - list_id
        - type
        - name
        - description
        - entries
        - namespace_type
        - comments
        - tie_breaker_id
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        _version:
          type: string
          description: 'The version id, normally returned by the API when the item was retrieved. Use it ensure updates are done against the latest version.'
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemCommentArray'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
        created_by:
          type: string
          description: Autogenerated value - user that created object.
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        entries:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
        expire_time:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        list_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        os_types:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
        tie_breaker_id:
          type: string
          description: Field used in search to ensure all containers are sorted and returned correctly.
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
        updated_by:
          type: string
          description: Autogenerated value - user that last updated object.
    Security_Exceptions_API_ExceptionListItemComment:
      required:
        - id
        - comment
        - created_at
        - created_by
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
        created_by:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
        updated_by:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_ExceptionListItemCommentArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemComment'
      description: "Array of comment fields:\n\n- comment (string): Comments about the exception item.\n"
    Security_Exceptions_API_ExceptionListItemDescription:
      type: string
      description: Describes the exception list.
    Security_Exceptions_API_ExceptionListItemEntry:
      anyOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryList'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNested'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchWildcard'
      discriminator:
        propertyName: type
    Security_Exceptions_API_ExceptionListItemEntryArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntry'
    Security_Exceptions_API_ExceptionListItemEntryExists:
      required:
        - type
        - field
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - exists
          type: string
    Security_Exceptions_API_ExceptionListItemEntryList:
      required:
        - type
        - field
        - list
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        list:
          required:
            - id
            - type
          type: object
          properties:
            id:
              $ref: '#/components/schemas/Security_Exceptions_API_ListId'
            type:
              $ref: '#/components/schemas/Security_Exceptions_API_ListType'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - list
          type: string
    Security_Exceptions_API_ExceptionListItemEntryMatch:
      required:
        - type
        - field
        - value
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - match
          type: string
        value:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_ExceptionListItemEntryMatchAny:
      required:
        - type
        - field
        - value
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - match_any
          type: string
        value:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_ExceptionListItemEntryMatchWildcard:
      required:
        - type
        - field
        - value
        - operator
      type: object
      properties:
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        operator:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryOperator'
        type:
          enum:
            - wildcard
          type: string
        value:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_ExceptionListItemEntryNested:
      required:
        - type
        - field
        - entries
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem'
        field:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        type:
          enum:
            - nested
          type: string
    Security_Exceptions_API_ExceptionListItemEntryNestedEntryItem:
      oneOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatch'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryMatchAny'
        - $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryExists'
    Security_Exceptions_API_ExceptionListItemEntryOperator:
      enum:
        - excluded
        - included
      type: string
    Security_Exceptions_API_ExceptionListItemExpireTime:
      type: string
      description: 'The exception item’s expiration date, in ISO format. This field is only available for regular exception items, not endpoint exceptions.'
      format: date-time
    Security_Exceptions_API_ExceptionListItemHumanId:
      minLength: 1
      type: string
      description: 'Human readable string identifier, e.g. `trusted-linux-processes`'
      format: nonempty
      example: simple_list_item
    Security_Exceptions_API_ExceptionListItemId:
      minLength: 1
      type: string
      description: Exception's identifier.
      format: nonempty
      example: 71a9f4b2-c85c-49b4-866f-c71eb9e67da2
    Security_Exceptions_API_ExceptionListItemMeta:
      type: object
    Security_Exceptions_API_ExceptionListItemName:
      minLength: 1
      type: string
      description: Exception list name.
      format: nonempty
    Security_Exceptions_API_ExceptionListItemOsTypeArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsType'
    Security_Exceptions_API_ExceptionListItemTags:
      type: array
      items:
        minLength: 1
        type: string
        description: String array containing words and phrases to help categorize exception items.
        format: nonempty
    Security_Exceptions_API_ExceptionListItemType:
      enum:
        - simple
      type: string
    Security_Exceptions_API_ExceptionListMeta:
      type: object
      description: Placeholder for metadata about the list container.
    Security_Exceptions_API_ExceptionListName:
      type: string
      description: The name of the exception list.
      example: My exception list
    Security_Exceptions_API_ExceptionListOsType:
      enum:
        - linux
        - macos
        - windows
      type: string
      description: Use this field to specify the operating system.
    Security_Exceptions_API_ExceptionListOsTypeArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListOsType'
      description: Use this field to specify the operating system. Only enter one value.
    Security_Exceptions_API_ExceptionListsImportBulkError:
      required:
        - error
      type: object
      properties:
        error:
          required:
            - status_code
            - message
          type: object
          properties:
            message:
              type: string
            status_code:
              type: integer
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListId'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        list_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
    Security_Exceptions_API_ExceptionListsImportBulkErrorArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListsImportBulkError'
    Security_Exceptions_API_ExceptionListTags:
      type: array
      items:
        type: string
      description: String array containing words and phrases to help categorize exception containers.
    Security_Exceptions_API_ExceptionListType:
      enum:
        - detection
        - rule_default
        - endpoint
        - endpoint_trusted_apps
        - endpoint_trusted_devices
        - endpoint_events
        - endpoint_host_isolation_exceptions
        - endpoint_blocklists
        - endpoint_custom_yara_signatures
      type: string
      description: The type of exception list to be created. Different list types may denote where they can be utilized.
    Security_Exceptions_API_ExceptionListVersion:
      minimum: 1
      type: integer
      description: 'The document version, automatically increasd on updates.'
    Security_Exceptions_API_ExceptionNamespaceType:
      enum:
        - agnostic
        - single
      type: string
      description: "Determines whether the exception container is available in all Kibana spaces or just the space\nin which it is created, where:\n\n- `single`: Only available in the Kibana space in which it is created.\n- `agnostic`: Available in all Kibana spaces.\n\nFor endpoint artifacts, the `namespace_type` must always be `agnostic`. Space awareness for endpoint artifacts is enforced based on Elastic Defend policy assignments.\n"
    Security_Exceptions_API_FindExceptionListItemsFilter:
      $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_FindExceptionListsFilter:
      type: string
      example: exception-list.attributes.name:%Detection%20List
    Security_Exceptions_API_HostIsolationProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          maxItems: 1
          minItems: 1
          type: array
          items:
            required:
              - field
              - type
              - value
              - operator
            type: object
            properties:
              field:
                enum:
                  - destination.ip
                type: string
                description: Must be destination.ip
              operator:
                enum:
                  - included
                type: string
                description: Must be the value "included"
              type:
                enum:
                  - match
                type: string
                description: Must be match
              value:
                type: string
                description: 'Valid IPv4 address or CIDR notation (e.g., "192.168.1.1" or "10.0.0.0/8")'
          description: Exactly one entry allowed for host isolation exceptions
        list_id:
          enum:
            - endpoint_host_isolation_exceptions
          type: string
          example: endpoint_host_isolation_exceptions
        os_types:
          maxItems: 3
          minItems: 3
          type: array
          items:
            enum:
              - windows
              - linux
              - macos
            type: string
          description: 'Must include all three operating systems (windows, linux, macos)'
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: Host isolation exceptions list item properties.
    Security_Exceptions_API_ListId:
      minLength: 1
      type: string
      description: Value list's identifier.
      format: nonempty
      example: 21b01cfb-058d-44b9-838c-282be16c91cd
    Security_Exceptions_API_ListType:
      enum:
        - binary
        - boolean
        - byte
        - date
        - date_nanos
        - date_range
        - double
        - double_range
        - float
        - float_range
        - geo_point
        - geo_shape
        - half_float
        - integer
        - integer_range
        - ip
        - ip_range
        - keyword
        - long
        - long_range
        - shape
        - short
        - text
      type: string
      description: "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:\n\n- `keyword`: Many ECS fields are Elasticsearch keywords\n- `ip`: IP addresses\n- `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)\n"
    Security_Exceptions_API_NonEmptyString:
      minLength: 1
      type: string
      description: A string that does not contain only whitespace characters
      format: nonempty
    Security_Exceptions_API_PlatformErrorResponse:
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
    Security_Exceptions_API_RuleId:
      $ref: '#/components/schemas/Security_Exceptions_API_UUID'
    Security_Exceptions_API_SiemErrorResponse:
      required:
        - status_code
        - message
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
    Security_Exceptions_API_TrustedAppHashEntry:
      required:
        - field
        - type
        - value
        - operator
      type: object
      properties:
        field:
          enum:
            - process.hash.md5
            - process.hash.sha1
            - process.hash.sha256
          type: string
          description: Process hash field
        operator:
          enum:
            - included
          type: string
        type:
          enum:
            - match
          type: string
          description: Hash entries only support match type
        value:
          type: string
          description: 'Hash value (MD5, SHA1, or SHA256)'
    Security_Exceptions_API_TrustedAppMacCodeSignatureEntry:
      required:
        - field
        - type
        - entries
      type: object
      properties:
        entries:
          maxItems: 2
          minItems: 2
          type: array
          items:
            oneOf:
              - required:
                  - field
                  - type
                  - value
                  - operator
                type: object
                properties:
                  field:
                    enum:
                      - subject_name
                    type: string
                  operator:
                    enum:
                      - included
                    type: string
                  type:
                    enum:
                      - match
                    type: string
                  value:
                    type: string
                    description: Certificate subject name
              - required:
                  - field
                  - type
                  - value
                  - operator
                type: object
                properties:
                  field:
                    enum:
                      - trusted
                    type: string
                  operator:
                    enum:
                      - included
                    type: string
                  type:
                    enum:
                      - match
                    type: string
                  value:
                    enum:
                      - 'true'
                    type: string
                    description: Must be the string 'true'
          description: Must include exactly 2 entries - one for subject_name and one for trusted
        field:
          enum:
            - process.code_signature
          type: string
          description: macOS code signature field
        type:
          enum:
            - nested
          type: string
    Security_Exceptions_API_TrustedAppPathEntry:
      required:
        - field
        - type
        - value
        - operator
      type: object
      properties:
        field:
          enum:
            - process.executable.caseless
          type: string
          description: Process executable path field
        operator:
          enum:
            - included
          type: string
        type:
          enum:
            - match
            - wildcard
          type: string
          description: Path supports both match and wildcard types
        value:
          type: string
          description: Executable path
    Security_Exceptions_API_TrustedAppsLinuxProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry'
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry'
          description: Process hash or executable path entries (code signature not supported on Linux)
        list_id:
          enum:
            - endpoint_trusted_apps
          type: string
          example: endpoint_trusted_apps
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - linux
            type: string
          description: Must be Linux only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: Trusted applications list item properties (Linux).
    Security_Exceptions_API_TrustedAppsMacProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry'
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry'
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppMacCodeSignatureEntry'
          description: 'Process hash, executable path, or code signature entries'
        list_id:
          enum:
            - endpoint_trusted_apps
          type: string
          example: endpoint_trusted_apps
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - macos
            type: string
          description: Must be macOS only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: Trusted applications list item properties (macOS).
    Security_Exceptions_API_TrustedAppsWindowsProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            oneOf:
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppHashEntry'
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppPathEntry'
              - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppWindowsCodeSignatureEntry'
          description: 'Process hash, executable path, or code signature entries'
        list_id:
          enum:
            - endpoint_trusted_apps
          type: string
          example: endpoint_trusted_apps
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - windows
            type: string
          description: Must be Windows only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: Trusted applications list item properties (Windows).
    Security_Exceptions_API_TrustedAppWindowsCodeSignatureEntry:
      required:
        - field
        - type
        - entries
      type: object
      properties:
        entries:
          maxItems: 2
          minItems: 2
          type: array
          items:
            oneOf:
              - required:
                  - field
                  - type
                  - value
                  - operator
                type: object
                properties:
                  field:
                    enum:
                      - subject_name
                    type: string
                  operator:
                    enum:
                      - included
                    type: string
                  type:
                    enum:
                      - match
                    type: string
                  value:
                    type: string
                    description: Certificate subject name
              - required:
                  - field
                  - type
                  - value
                  - operator
                type: object
                properties:
                  field:
                    enum:
                      - trusted
                    type: string
                  operator:
                    enum:
                      - included
                    type: string
                  type:
                    enum:
                      - match
                    type: string
                  value:
                    enum:
                      - 'true'
                    type: string
                    description: Must be the string 'true'
          description: Must include exactly 2 entries - one for subject_name and one for trusted
        field:
          enum:
            - process.Ext.code_signature
          type: string
          description: Windows code signature field
        type:
          enum:
            - nested
          type: string
    Security_Exceptions_API_TrustedDevicesMacProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            required:
              - field
              - type
              - value
              - operator
            type: object
            properties:
              field:
                enum:
                  - device.serial_number
                  - device.type
                  - host.name
                  - device.vendor.name
                  - device.vendor.id
                  - device.product.id
                  - device.product.name
                type: string
                description: Device field to match against
              operator:
                enum:
                  - included
                type: string
                description: Must be the value "included"
              type:
                enum:
                  - match
                  - wildcard
                  - match_any
                type: string
                description: Entry match type
              value:
                oneOf:
                  - type: string
                    description: Single value (used with match or wildcard)
                  - minItems: 1
                    type: array
                    items:
                      type: string
                    description: Array of values (used with match_any)
          description: Exception entries for the trusted device (duplicate field entries are not allowed)
        list_id:
          enum:
            - endpoint_trusted_devices
          type: string
          example: endpoint_trusted_devices
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - macos
            type: string
          description: macOS-only
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: 'Trusted devices list item properties (macOS-only, username not supported).'
    Security_Exceptions_API_TrustedDevicesWindowsMacProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            required:
              - field
              - type
              - value
              - operator
            type: object
            properties:
              field:
                enum:
                  - device.serial_number
                  - device.type
                  - host.name
                  - device.vendor.name
                  - device.vendor.id
                  - device.product.id
                  - device.product.name
                type: string
                description: Device field to match against (username not available for multi-OS)
              operator:
                enum:
                  - included
                type: string
                description: Must be the value "included"
              type:
                enum:
                  - match
                  - wildcard
                  - match_any
                type: string
                description: Entry match type
              value:
                oneOf:
                  - type: string
                    description: Single value (used with match or wildcard)
                  - minItems: 1
                    type: array
                    items:
                      type: string
                    description: Array of values (used with match_any)
          description: 'Exception entries for the trusted device (duplicate field entries are not allowed, username not available when targeting both OS)'
        list_id:
          enum:
            - endpoint_trusted_devices
          type: string
          example: endpoint_trusted_devices
        os_types:
          maxItems: 2
          minItems: 2
          type: array
          items:
            enum:
              - windows
              - macos
            type: string
          description: Must include both Windows and macOS (username field not allowed)
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: 'Trusted devices list item properties (Windows + macOS, username not supported).'
    Security_Exceptions_API_TrustedDevicesWindowsProperties:
      required:
        - list_id
      type: object
      properties:
        entries:
          minItems: 1
          type: array
          items:
            required:
              - field
              - type
              - value
              - operator
            type: object
            properties:
              field:
                enum:
                  - device.serial_number
                  - device.type
                  - host.name
                  - device.vendor.name
                  - device.vendor.id
                  - device.product.id
                  - device.product.name
                  - user.name
                type: string
                description: Device field to match against (user.name is Windows-only)
              operator:
                enum:
                  - included
                type: string
                description: Must be the value "included"
              type:
                enum:
                  - match
                  - wildcard
                  - match_any
                type: string
                description: Entry match type
              value:
                oneOf:
                  - type: string
                    description: Single value (used with match or wildcard)
                  - minItems: 1
                    type: array
                    items:
                      type: string
                    description: Array of values (used with match_any)
          description: Exception entries for the trusted device (duplicate field entries are not allowed)
        list_id:
          enum:
            - endpoint_trusted_devices
          type: string
          example: endpoint_trusted_devices
        os_types:
          maxItems: 1
          minItems: 1
          type: array
          items:
            enum:
              - windows
            type: string
          description: Must be Windows-only to allow username field
        tags:
          $ref: '#/components/schemas/Security_Exceptions_API_EndpointArtifactTags'
      description: 'Trusted devices list item properties (Windows-only, allows username field).'
    Security_Exceptions_API_UpdateExceptionListItemBase:
      required:
        - type
        - name
        - description
      type: object
      properties:
        _version:
          type: string
          description: 'The version ID, normally returned by the API when the item is retrieved. Use it to ensure updates are made against the latest version.'
        comments:
          $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemCommentArray'
        description:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemDescription'
        expire_time:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemExpireTime'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemId'
        item_id:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemHumanId'
        meta:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemMeta'
        name:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemName'
        namespace_type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionNamespaceType'
        type:
          $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemType'
    Security_Exceptions_API_UpdateExceptionListItemBlocklistLinux:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistLinuxProperties'
    Security_Exceptions_API_UpdateExceptionListItemBlocklistMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistMacProperties'
    Security_Exceptions_API_UpdateExceptionListItemBlocklistWindows:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_BlocklistWindowsProperties'
    Security_Exceptions_API_UpdateExceptionListItemComment:
      required:
        - comment
      type: object
      properties:
        comment:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
        id:
          $ref: '#/components/schemas/Security_Exceptions_API_NonEmptyString'
    Security_Exceptions_API_UpdateExceptionListItemCommentArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemComment'
    Security_Exceptions_API_UpdateExceptionListItemEndpointList:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_EndpointListProperties'
    Security_Exceptions_API_UpdateExceptionListItemEventFilters:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_EventFiltersProperties'
    Security_Exceptions_API_UpdateExceptionListItemGeneric:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - required:
            - entries
          type: object
          properties:
            entries:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemEntryArray'
            list_id:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListHumanId'
            os_types:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemOsTypeArray'
            tags:
              $ref: '#/components/schemas/Security_Exceptions_API_ExceptionListItemTags'
          example:
            comments: [ ]
            description: Updated description
            entries:
              - field: host.name
                operator: included
                type: match
                value: rock01
            item_id: simple_list_item
            name: Updated name
            namespace_type: single
            tags: [ ]
            type: simple
    Security_Exceptions_API_UpdateExceptionListItemHostIsolation:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_HostIsolationProperties'
    Security_Exceptions_API_UpdateExceptionListItemTrustedAppsLinux:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsLinuxProperties'
    Security_Exceptions_API_UpdateExceptionListItemTrustedAppsMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsMacProperties'
    Security_Exceptions_API_UpdateExceptionListItemTrustedAppsWindows:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedAppsWindowsProperties'
    Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesMacProperties'
    Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindows:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsProperties'
    Security_Exceptions_API_UpdateExceptionListItemTrustedDevicesWindowsMac:
      allOf:
        - $ref: '#/components/schemas/Security_Exceptions_API_UpdateExceptionListItemBase'
        - $ref: '#/components/schemas/Security_Exceptions_API_TrustedDevicesWindowsMacProperties'
    Security_Exceptions_API_UUID:
      type: string
      description: A universally unique identifier
      format: uuid
    Security_Lists_API_FindListItemsCursor:
      minLength: 1
      type: string
      description: Returns the items that come after the last item returned in the previous call (use the `cursor` value returned in the previous call). This parameter uses the `tie_breaker_id` field to ensure all items are sorted and returned correctly.
      format: nonempty
      example: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
    Security_Lists_API_FindListItemsFilter:
      type: string
      example: value:127.0.0.1
    Security_Lists_API_FindListsCursor:
      minLength: 1
      type: string
      format: nonempty
      example: WzIwLFsiYjU3Yzc2MmMtMzAzNi00NjVjLTliZmItN2JmYjVlNmU1MTVhIl1d
    Security_Lists_API_FindListsFilter:
      type: string
      example: value:127.0.0.1
    Security_Lists_API_List:
      required:
        - id
        - type
        - name
        - description
        - immutable
        - version
        - tie_breaker_id
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        _version:
          $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
        '@timestamp':
          type: string
          format: date-time
          example: '2025-01-08T04:47:34.273Z'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
          example: '2025-01-08T04:47:34.273Z'
        created_by:
          type: string
          description: Autogenerated value - user that created object.
          example: elastic
        description:
          $ref: '#/components/schemas/Security_Lists_API_ListDescription'
        id:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
        immutable:
          type: boolean
        meta:
          $ref: '#/components/schemas/Security_Lists_API_ListMetadata'
        name:
          $ref: '#/components/schemas/Security_Lists_API_ListName'
        tie_breaker_id:
          type: string
          description: Field used in search to ensure all containers are sorted and returned correctly.
          example: f5508188-b1e9-4e6e-9662-d039a7d89899
        type:
          $ref: '#/components/schemas/Security_Lists_API_ListType'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
          example: '2025-01-08T04:47:34.273Z'
        updated_by:
          type: string
          description: Autogenerated value - user that last updated object.
          example: elastic
        version:
          $ref: '#/components/schemas/Security_Lists_API_ListVersion'
    Security_Lists_API_ListDescription:
      minLength: 1
      type: string
      description: Describes the value list.
      format: nonempty
    Security_Lists_API_ListId:
      minLength: 1
      type: string
      description: Value list's identifier.
      format: nonempty
      example: 21b01cfb-058d-44b9-838c-282be16c91cd
    Security_Lists_API_ListItem:
      required:
        - id
        - type
        - list_id
        - value
        - tie_breaker_id
        - created_at
        - created_by
        - updated_at
        - updated_by
      type: object
      properties:
        _version:
          $ref: '#/components/schemas/Security_Lists_API_ListVersionId'
        '@timestamp':
          type: string
          format: date-time
          example: '2025-01-08T04:47:34.273Z'
        created_at:
          type: string
          description: Autogenerated date of object creation.
          format: date-time
          example: '2025-01-08T04:47:34.273Z'
        created_by:
          type: string
          description: Autogenerated value - user that created object.
          example: elastic
        id:
          $ref: '#/components/schemas/Security_Lists_API_ListItemId'
        list_id:
          $ref: '#/components/schemas/Security_Lists_API_ListId'
        meta:
          $ref: '#/components/schemas/Security_Lists_API_ListItemMetadata'
        tie_breaker_id:
          type: string
          description: Field used in search to ensure all containers are sorted and returned correctly.
          example: f5508188-b1e9-4e6e-9662-d039a7d89899
        type:
          $ref: '#/components/schemas/Security_Lists_API_ListType'
        updated_at:
          type: string
          description: Autogenerated date of last object update.
          format: date-time
          example: '2025-01-08T04:47:34.273Z'
        updated_by:
          type: string
          description: Autogenerated value - user that last updated object.
          example: elastic
        value:
          $ref: '#/components/schemas/Security_Lists_API_ListItemValue'
    Security_Lists_API_ListItemId:
      minLength: 1
      type: string
      description: Value list item's identifier.
      format: nonempty
      example: 54b01cfb-058d-44b9-838c-282be16c91cd
    Security_Lists_API_ListItemMetadata:
      type: object
      description: Placeholder for metadata about the value list item.
    Security_Lists_API_ListItemPrivileges:
      required:
        - username
        - has_all_requested
        - cluster
        - index
        - application
      type: object
      properties:
        application:
          type: object
          additionalProperties:
            type: boolean
        cluster:
          type: object
          additionalProperties:
            type: boolean
        has_all_requested:
          type: boolean
        index:
          type: object
          additionalProperties:
            type: object
            additionalProperties:
              type: boolean
        username:
          type: string
    Security_Lists_API_ListItemValue:
      minLength: 1
      type: string
      description: The value used to evaluate exceptions.
      format: nonempty
    Security_Lists_API_ListMetadata:
      type: object
      description: Placeholder for metadata about the value list.
    Security_Lists_API_ListName:
      minLength: 1
      type: string
      description: Value list's name.
      format: nonempty
      example: List of bad IPs
    Security_Lists_API_ListPrivileges:
      required:
        - username
        - has_all_requested
        - cluster
        - index
        - application
      type: object
      properties:
        application:
          type: object
          additionalProperties:
            type: boolean
        cluster:
          type: object
          additionalProperties:
            type: boolean
        has_all_requested:
          type: boolean
        index:
          type: object
          additionalProperties:
            type: object
            additionalProperties:
              type: boolean
        username:
          type: string
    Security_Lists_API_ListType:
      enum:
        - binary
        - boolean
        - byte
        - date
        - date_nanos
        - date_range
        - double
        - double_range
        - float
        - float_range
        - geo_point
        - geo_shape
        - half_float
        - integer
        - integer_range
        - ip
        - ip_range
        - keyword
        - long
        - long_range
        - shape
        - short
        - text
      type: string
      description: "Specifies the Elasticsearch data type of excludes the list container holds. Some common examples:\n\n- `keyword`: Many ECS fields are Elasticsearch keywords\n- `ip`: IP addresses\n- `ip_range`: Range of IP addresses (supports IPv4, IPv6, and CIDR notation)\n"
    Security_Lists_API_ListVersion:
      minimum: 1
      type: integer
      description: The document version number.
      example: 1
    Security_Lists_API_ListVersionId:
      type: string
      description: "The version id, normally returned by the API when the document is retrieved. Use it ensure updates are done against the latest version.\n"
      example: WzIsMV0=
    Security_Lists_API_PlatformErrorResponse:
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
        message:
          type: string
        statusCode:
          type: integer
    Security_Lists_API_SiemErrorResponse:
      required:
        - status_code
        - message
      type: object
      properties:
        message:
          type: string
        status_code:
          type: integer
    Security_Osquery_API_ArrayQueries:
      type: array
      items:
        $ref: '#/components/schemas/Security_Osquery_API_ArrayQueriesItem'
      description: An array of queries to run.
    Security_Osquery_API_ArrayQueriesItem:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        enabled:
          $ref: '#/components/schemas/Security_Osquery_API_QueryEnabled'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_QueryId'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        result_type:
          $ref: '#/components/schemas/Security_Osquery_API_ResultType'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Osquery_API_CopyPacksResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - name
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            interval:
              $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
            min_osquery_version:
              $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              type: array
              items:
                type: object
                properties:
                  ecs_mapping:
                    $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArray'
                  enabled:
                    $ref: '#/components/schemas/Security_Osquery_API_QueryEnabled'
                  id:
                    type: string
                  interval:
                    type: integer
                  platform:
                    type: string
                  query:
                    type: string
                  removed:
                    type: boolean
                  result_type:
                    $ref: '#/components/schemas/Security_Osquery_API_ResultType'
                  rrule_schedule:
                    $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
                  schedule_type:
                    $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
                  snapshot:
                    type: boolean
                  timeout:
                    type: integer
                  version:
                    type: string
              description: 'Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.'
            result_type:
              $ref: '#/components/schemas/Security_Osquery_API_ResultType'
            rrule_schedule:
              $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
            saved_object_id:
              type: string
              description: The saved object ID of the copied pack.
            schedule_type:
              $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
            shards:
              type: array
              items:
                type: object
                properties:
                  key:
                    type: string
                  value:
                    type: number
              description: Shard configuration as an array of key-value pairs.
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
            version:
              type: integer
              description: The pack version number.
      description: The response for copying a pack.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: My pack
          enabled: false
          name: my_pack_copy
          policy_ids: [ ]
          queries:
            - ecs_mapping:
                - key: client.port
                  value:
                    field: port
              id: ports
              interval: 60
              query: SELECT * FROM listening_ports;
              removed: false
              snapshot: true
              timeout: 120
          saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
          shards: [ ]
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
    Security_Osquery_API_CopySavedQueryResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - id
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              type:
                - integer
                - string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
      description: The response for copying a saved query.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: my_saved_query_copy
          interval: '60'
          platform: 'linux,darwin'
          query: select * from uptime;
          removed: false
          saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
          snapshot: true
          timeout: 120
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
    Security_Osquery_API_CreateLiveQueryRequestBody:
      type: object
      properties:
        agent_all:
          type: boolean
          description: 'When `true`, the query runs on all agents.'
        agent_ids:
          type: array
          items:
            type: string
          description: A list of agent IDs to run the query on.
        agent_platforms:
          type: array
          items:
            type: string
          description: A list of agent platforms to run the query on.
        agent_policy_ids:
          type: array
          items:
            type: string
          description: A list of agent policy IDs to run the query on.
        alert_ids:
          type: array
          items:
            type: string
          description: A list of alert IDs associated with the live query.
        case_ids:
          type: array
          items:
            type: string
          description: A list of case IDs associated with the live query.
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        event_ids:
          type: array
          items:
            type: string
          description: A list of event IDs associated with the live query.
        metadata:
          type:
            - 'null'
            - object
          description: Custom metadata object associated with the live query.
        pack_id:
          $ref: '#/components/schemas/Security_Osquery_API_PackId'
        queries:
          $ref: '#/components/schemas/Security_Osquery_API_ArrayQueries'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        saved_query_id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
      example:
        agent_all: true
        ecs_mapping:
          host.uptime:
            field: total_seconds
        query: select * from uptime;
    Security_Osquery_API_CreateLiveQueryResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - action_id
          type: object
          properties:
            '@timestamp':
              type: string
              description: The timestamp when the action was created.
              format: date-time
            action_id:
              type: string
              description: The ID of the action.
            agent_all:
              type: boolean
              description: Whether the query targets all agents.
            agent_ids:
              type: array
              items:
                type: string
              description: The agent IDs targeted by the action.
            agent_platforms:
              type: array
              items:
                type: string
              description: The agent platforms targeted.
            agent_policy_ids:
              type: array
              items:
                type: string
              description: The agent policy IDs targeted.
            agents:
              type: array
              items:
                type: string
              description: The resolved list of agent IDs.
            expiration:
              type: string
              description: The expiration date of the action.
              format: date-time
            input_type:
              type: string
              description: The input type.
            metadata:
              type: object
              description: Custom metadata associated with the action.
            pack_id:
              type: string
              description: The pack ID if the query was run from a pack.
            queries:
              type: array
              items:
                type: object
                properties:
                  action_id:
                    type: string
                  agents:
                    type: array
                    items:
                      type: string
                  ecs_mapping:
                    $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
                  id:
                    type: string
                  platform:
                    type: string
                  query:
                    type: string
                  saved_query_id:
                    type: string
                  timeout:
                    type: integer
                  version:
                    type: string
              description: The queries in this action.
            type:
              type: string
              description: The action type.
            user_id:
              type: string
              description: The user who created the action.
      description: The response for creating a live query.
      example:
        data:
          '@timestamp': '2022-07-26T09:59:32.220Z'
          action_id: 3c42c847-eb30-4452-80e0-728584042334
          agent_all: true
          agent_ids: [ ]
          agent_platforms: [ ]
          agent_policy_ids: [ ]
          agents:
            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
          expiration: '2022-07-26T10:04:32.220Z'
          input_type: osquery
          metadata:
            execution_context:
              name: osquery
              url: /app/osquery/new
          queries:
            - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
              agents:
                - 16d7caf5-efd2-4212-9b62-73dafc91fa13
              ecs_mapping:
                host.uptime:
                  field: total_seconds
              id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
              query: select * from uptime;
              timeout: 120
          type: INPUT_ACTION
          user_id: elastic
    Security_Osquery_API_CreatePacksRequestBody:
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
        enabled:
          $ref: '#/components/schemas/Security_Osquery_API_Enabled'
        interval:
          $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
        min_osquery_version:
          $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
        name:
          $ref: '#/components/schemas/Security_Osquery_API_PackName'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
        policy_ids:
          $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
        queries:
          $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
        result_type:
          $ref: '#/components/schemas/Security_Osquery_API_ResultType'
        rrule_schedule:
          $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
        schedule_type:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
        shards:
          $ref: '#/components/schemas/Security_Osquery_API_Shards'
      example:
        description: My pack
        enabled: true
        name: my_pack
        policy_ids:
          - my_policy_id
          - fleet-server-policy
        queries:
          my_query:
            ecs_mapping:
              client.port:
                field: port
              tags:
                value:
                  - tag1
                  - tag2
            interval: 60
            query: SELECT * FROM listening_ports;
            timeout: 120
        shards:
          fleet-server-policy: 58
          my_policy_id: 35
    Security_Osquery_API_CreatePacksResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - name
          type: object
          properties:
            created_at:
              type: string
              description: The date and time the pack was created.
              format: date-time
            created_by:
              type:
                - 'null'
                - string
              description: The user who created the pack.
            created_by_profile_uid:
              type: string
              description: The profile UID of the user who created the pack.
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            interval:
              $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
            min_osquery_version:
              $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
            result_type:
              $ref: '#/components/schemas/Security_Osquery_API_ResultType'
            rrule_schedule:
              $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
            saved_object_id:
              type: string
              description: The saved object ID of the pack.
            schedule_type:
              $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
            shards:
              type: array
              items:
                type: object
                properties:
                  key:
                    type: string
                  value:
                    type: number
              description: Shard configuration as an array of key-value pairs.
            updated_at:
              type: string
              description: The date and time the pack was last updated.
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
              description: The user who last updated the pack.
            updated_by_profile_uid:
              type: string
              description: The profile UID of the user who last updated the pack.
            version:
              type: integer
              description: The pack version number.
      description: The response for creating a pack.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: My pack
          enabled: true
          name: my_pack
          policy_ids:
            - my_policy_id
          queries:
            ports:
              ecs_mapping:
                client.port:
                  field: port
              interval: 60
              query: SELECT * FROM listening_ports;
              removed: false
              snapshot: true
              timeout: 120
          saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
          shards:
            47638692-7c4c-4053-aa3e-7186f28df349: 35
            5e267651-fe50-443e-8d3f-3bbc9171b618: 58
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
          version: 1
    Security_Osquery_API_CreateSavedQueryRequestBody:
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
        interval:
          $ref: '#/components/schemas/Security_Osquery_API_Interval'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
      example:
        description: Saved query description
        ecs_mapping:
          host.uptime:
            field: total_seconds
        id: saved_query_id
        interval: '60'
        platform: 'linux,darwin'
        query: select * from uptime;
        timeout: 120
        version: '2.8.0'
    Security_Osquery_API_CreateSavedQueryResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - id
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              type:
                - integer
                - string
              description: 'An interval, in seconds, on which to run the query. May be returned as number or string.'
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            prebuilt:
              type: boolean
              description: Whether the saved query is prebuilt.
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
              description: The saved object ID of the saved query.
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
              description: The query timeout in seconds.
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
            version:
              type:
                - integer
                - string
              description: The saved query version.
      description: The response for creating a saved query.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: saved_query_id
          interval: '60'
          platform: 'linux,darwin'
          prebuilt: false
          query: select * from uptime;
          saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
          timeout: 120
          updated_at: '2025-02-26T13:37:30.452Z'
          updated_by: elastic
          version: '2.8.0'
    Security_Osquery_API_DefaultSuccessResponse:
      type: object
    Security_Osquery_API_ECSMapping:
      type: object
      additionalProperties:
        $ref: '#/components/schemas/Security_Osquery_API_ECSMappingItem'
      description: Map osquery results columns or static values to Elastic Common Schema (ECS) fields
      example:
        host.uptime:
          field: total_seconds
    Security_Osquery_API_ECSMappingArray:
      type: array
      items:
        $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArrayItem'
      description: ECS mapping in saved-object storage format (array of key-value pairs). The find and copy pack endpoints return this format. The read endpoint returns object format (ECSMapping).
    Security_Osquery_API_ECSMappingArrayItem:
      type: object
      properties:
        key:
          type: string
          description: The ECS field name.
        value:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMappingItem'
      description: ECS mapping item in saved-object storage format (key-value pair).
    Security_Osquery_API_ECSMappingArrayOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArray'
    Security_Osquery_API_ECSMappingItem:
      type: object
      properties:
        field:
          type: string
          description: The ECS field to map to.
          example: host.uptime
        value:
          oneOf:
            - type: string
            - type: array
              items:
                type: string
          description: The value to map to the ECS field.
          example: total_seconds
    Security_Osquery_API_ECSMappingOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
    Security_Osquery_API_Enabled:
      type: boolean
      description: Enables the pack.
      example: true
    Security_Osquery_API_EnabledOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Enabled'
    Security_Osquery_API_ExportFormat:
      enum:
        - ndjson
        - json
        - csv
      type: string
      description: "The output format for the exported file. Use `ndjson` for streaming newline-delimited JSON (recommended for large exports), `json` for a single JSON array (held in memory; suitable for smaller result sets), or `csv` for a comma-separated values file with a header row derived from the ECS mapping.\n"
      example: ndjson
    Security_Osquery_API_ExportJsonResponse:
      required:
        - _meta
        - results
      type: object
      properties:
        _meta:
          $ref: '#/components/schemas/Security_Osquery_API_ExportMetadata'
        results:
          type: array
          items:
            $ref: '#/components/schemas/Security_Osquery_API_ExportResultRow'
      description: "JSON export response body. The `_meta` field contains export metadata; `results` contains all result rows. Prefer `ndjson` for large exports since rows are streamed individually rather than held in memory.\n"
    Security_Osquery_API_ExportMetadata:
      required:
        - action_id
        - timestamp
        - exported_by
        - format
      type: object
      properties:
        action_id:
          type: string
          description: The action ID (live query) or schedule ID (scheduled query) that produced the results.
          example: e88d7652-fc3e-4544-b0e0-3d5df2be454c
        csv_columns:
          type:
            - 'null'
            - array
          items:
            type: string
          description: "For CSV exports with ECS mapping and zero hits: the column header row so an empty export is not a 0-byte file.\n"
        execution_count:
          type:
            - 'null'
            - integer
          description: "For scheduled query exports only: the execution counter of the scheduled run that produced the results.\n"
          example: 17384
        exported_by:
          type: string
          description: Username of the Kibana user who triggered the export.
          example: elastic
        format:
          $ref: '#/components/schemas/Security_Osquery_API_ExportFormat'
        query:
          type:
            - 'null'
            - string
          description: 'The SQL query text, if it could be resolved from action details.'
          example: SELECT * FROM users;
        timestamp:
          type: string
          description: ISO 8601 timestamp of when the export was initiated.
          format: date-time
          example: '2026-04-30T09:12:00.000Z'
        total_results:
          type:
            - 'null'
            - integer
          description: Total number of result rows included in this export.
          example: 64
      description: "Metadata block produced for every export. Included as `_meta` in the JSON response body and as the first NDJSON line.\n"
    Security_Osquery_API_ExportRequestBody:
      type:
        - 'null'
        - object
      properties:
        agentIds:
          type:
            - 'null'
            - array
          items:
            type: string
          description: "An optional allowlist of Elastic Agent IDs. When provided, only rows reported by the listed agents are included in the export.\n"
          example:
            - 980a6b73-0b03-4d1e-8915-67c202e4a980
            - e40fde1c-5729-4885-b0b2-16a42e9332e3
        esFilters:
          type:
            - 'null'
            - array
          items:
            type: object
          description: "An optional array of Elasticsearch / Kibana SearchBar filter objects (the same `esFilters` payload used by the Discover UI). Each filter is applied as an additional AND clause. An invalid filter object causes a 400 response rather than silently returning unfiltered data.\n"
          example:
            - meta:
                key: agent.name
                params:
                  query: prod-host-1
                type: phrase
              query:
                match_phrase:
                  agent.name: prod-host-1
        kuery:
          type:
            - 'null'
            - string
          description: "An optional KQL filter appended (with AND) to the base action/schedule filter. The filter is wrapped in parentheses so it cannot override or escape the built-in action_id / schedule_id gate.\n"
          example: 'host.name: "prod-host-1"'
      description: "Optional request body for export endpoints. All fields are optional. Omit the body or send `null` or `{}` to export all results without additional filtering.\n"
    Security_Osquery_API_ExportResultRow:
      type: object
      description: "A single result row from an NDJSON or JSON export. Fields follow the Elastic Common Schema (ECS) mapping defined on the originating query when available; otherwise raw osquery column names are used under the `osquery.*` namespace.\n"
      example:
        '@timestamp': '2026-04-30T09:11:58.321Z'
        agent:
          id: 980a6b73-0b03-4d1e-8915-67c202e4a980
          name: prod-host-1
          type: osquerybeat
          version: '9.4.0'
        osquery:
          directory: /home/ubuntu
          gid: '1000'
          shell: /bin/bash
          uid: '1000'
          username: ubuntu
        user:
          group:
            id: '1000'
          id: '1000'
          name: ubuntu
    Security_Osquery_API_FindLiveQueryDetailsResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            '@timestamp':
              type: string
              format: date-time
            action_id:
              type: string
            agents:
              type: array
              items:
                type: string
            expiration:
              type: string
              format: date-time
            pack_id:
              type: string
            pack_name:
              type: string
            prebuilt_pack:
              type: boolean
            queries:
              type: array
              items:
                type: object
                properties:
                  action_id:
                    type: string
                  agents:
                    type: array
                    items:
                      type: string
                  docs:
                    type: integer
                    description: Number of result documents.
                  ecs_mapping:
                    $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
                  failed:
                    type: integer
                    description: Number of failed queries.
                  id:
                    type: string
                  pending:
                    type: integer
                    description: Number of pending agents.
                  query:
                    type: string
                  responded:
                    type: integer
                    description: Total responded agents.
                  saved_query_id:
                    type: string
                  status:
                    enum:
                      - completed
                      - running
                    type: string
                    description: Status of this individual query.
                  successful:
                    type: integer
                    description: Number of successful agents.
              description: The queries with their execution status.
            status:
              enum:
                - completed
                - running
              type: string
              description: 'Global status of the live query (completed, running).'
            tags:
              type: array
              items:
                type: string
            user_id:
              type: string
            user_profile_uid:
              type: string
      example:
        data:
          '@timestamp': '2022-07-26T09:59:32.220Z'
          action_id: 3c42c847-eb30-4452-80e0-728584042334
          agents:
            - 16d7caf5-efd2-4212-9b62-73dafc91fa13
          expiration: '2022-07-26T10:04:32.220Z'
          queries:
            - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
              agents:
                - 16d7caf5-efd2-4212-9b62-73dafc91fa13
              docs: 0
              ecs_mapping:
                host.uptime:
                  field: total_seconds
              failed: 1
              id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
              pending: 0
              query: select * from uptime;
              responded: 1
              saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
              status: completed
              successful: 0
          status: completed
          user_id: elastic
    Security_Osquery_API_FindLiveQueryResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            items:
              type: array
              items:
                type: object
                properties:
                  _source:
                    type: object
                    properties:
                      '@timestamp':
                        type: string
                        format: date-time
                      action_id:
                        type: string
                      agents:
                        type: array
                        items:
                          type: string
                      expiration:
                        type: string
                        format: date-time
                      pack_id:
                        type: string
                      queries:
                        type: array
                        items:
                          type: object
                          properties:
                            action_id:
                              type: string
                            agents:
                              type: array
                              items:
                                type: string
                            ecs_mapping:
                              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
                            id:
                              type: string
                            query:
                              type: string
                            saved_query_id:
                              type: string
                      result_counts:
                        type: object
                        properties:
                          error_agents:
                            type: integer
                          responded_agents:
                            type: integer
                          successful_agents:
                            type: integer
                          total_rows:
                            type: integer
                        description: Result count statistics (present when withResultCounts is true).
                      user_id:
                        type: string
              description: An array of live query action items.
            total:
              type: integer
              description: The total number of live queries.
      example:
        data:
          items:
            - _source:
                '@timestamp': '2023-10-31T00:00:00Z'
                action_id: 3c42c847-eb30-4452-80e0-728584042334
                agents:
                  - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                expiration: '2023-10-31T00:00:00Z'
                queries:
                  - action_id: 609c4c66-ba3d-43fa-afdd-53e244577aa0
                    agents:
                      - 16d7caf5-efd2-4212-9b62-73dafc91fa13
                    ecs_mapping:
                      host.uptime:
                        field: total_seconds
                    id: 6724a474-cbba-41ef-a1aa-66aebf0879e2
                    query: select * from uptime;
                    saved_query_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
                result_counts:
                  error_agents: 0
                  responded_agents: 1
                  successful_agents: 1
                  total_rows: 42
                user_id: elastic
          total: 1
    Security_Osquery_API_FindPackResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - name
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            interval:
              $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
            min_osquery_version:
              $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            namespaces:
              type: array
              items:
                type: string
              description: The namespaces the pack belongs to.
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
            read_only:
              type: boolean
              description: Whether the pack is read-only (true for prebuilt packs).
            result_type:
              $ref: '#/components/schemas/Security_Osquery_API_ResultType'
            rrule_schedule:
              $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
            saved_object_id:
              type: string
              description: The saved object ID of the pack.
            schedule_type:
              $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
            shards:
              $ref: '#/components/schemas/Security_Osquery_API_Shards'
            type:
              type: string
              description: The saved object type.
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
            version:
              type: integer
              description: The pack version number.
          description: The pack details.
      description: The details of a single query pack.
      example:
        data:
          created_at: '2022-07-25T19:41:10.263Z'
          created_by: elastic
          description: ''
          enabled: true
          name: test_pack
          namespaces:
            - default
          policy_ids: [ ]
          queries:
            uptime:
              ecs_mapping:
                message:
                  field: days
              interval: 3600
              query: select * from uptime
          read_only: false
          saved_object_id: 3c42c847-eb30-4452-80e0-728584042334
          shards: { }
          type: osquery-pack
          updated_at: '2022-07-25T20:12:01.455Z'
          updated_by: elastic
          version: 1
    Security_Osquery_API_FindPacksResponse:
      required:
        - page
        - per_page
        - total
        - data
      type: object
      properties:
        data:
          type: array
          items:
            required:
              - saved_object_id
              - name
            type: object
            properties:
              created_at:
                type: string
                format: date-time
              created_by:
                type:
                  - 'null'
                  - string
              created_by_profile_uid:
                type: string
              description:
                $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
              enabled:
                $ref: '#/components/schemas/Security_Osquery_API_Enabled'
              interval:
                $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
              min_osquery_version:
                $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
              name:
                $ref: '#/components/schemas/Security_Osquery_API_PackName'
              platform:
                $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
              policy_ids:
                $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
              queries:
                type: array
                items:
                  type: object
                  properties:
                    ecs_mapping:
                      $ref: '#/components/schemas/Security_Osquery_API_ECSMappingArray'
                    enabled:
                      $ref: '#/components/schemas/Security_Osquery_API_QueryEnabled'
                    id:
                      type: string
                    interval:
                      type: integer
                    platform:
                      type: string
                    query:
                      type: string
                    removed:
                      type: boolean
                    result_type:
                      $ref: '#/components/schemas/Security_Osquery_API_ResultType'
                    rrule_schedule:
                      $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
                    schedule_type:
                      $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
                    snapshot:
                      type: boolean
                    timeout:
                      type: integer
                    version:
                      type: string
                description: 'Pack queries in saved-object storage format (array). Note: the read endpoint returns object format.'
              read_only:
                type: boolean
                description: Whether the pack is read-only (true for prebuilt packs).
              result_type:
                $ref: '#/components/schemas/Security_Osquery_API_ResultType'
              rrule_schedule:
                $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
              saved_object_id:
                type: string
                description: The saved object ID of the pack.
              schedule_type:
                $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
              updated_at:
                type: string
                format: date-time
              updated_by:
                type:
                  - 'null'
                  - string
              updated_by_profile_uid:
                type: string
              version:
                type: integer
                description: The pack version number.
          description: An array of pack objects.
        page:
          type: integer
          description: The current page number.
        per_page:
          type: integer
          description: The number of results per page.
        total:
          type: integer
          description: The total number of packs.
      description: A paginated list of query packs.
      example:
        data:
          - created_at: '2023-10-31T00:00:00Z'
            created_by: elastic
            created_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            description: My pack description
            enabled: true
            name: My Pack
            policy_ids: [ ]
            queries:
              - ecs_mapping:
                  - key: host.uptime
                    value:
                      field: total_seconds
                id: uptime
                interval: 3600
                query: select * from uptime;
            read_only: false
            saved_object_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
            updated_at: '2023-10-31T00:00:00Z'
            updated_by: elastic
            updated_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        page: 1
        per_page: 10
        total: 1
    Security_Osquery_API_FindSavedQueryDetailResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - id
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              type:
                - integer
                - string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            prebuilt:
              type: boolean
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
            version:
              type:
                - integer
                - string
      description: The details of a single saved query.
      example:
        data:
          created_at: '2022-07-26T09:28:08.597Z'
          created_by: elastic
          description: Saved query description
          ecs_mapping:
            host.uptime:
              field: total_seconds
          id: saved_query_id
          interval: '60'
          platform: 'linux,darwin'
          prebuilt: false
          query: select * from uptime;
          saved_object_id: 3c42c847-eb30-4452-80e0-728584042334
          updated_at: '2022-07-26T09:28:08.597Z'
          updated_by: elastic
          version: '2.8.0'
    Security_Osquery_API_FindSavedQueryResponse:
      required:
        - page
        - per_page
        - total
        - data
      type: object
      properties:
        data:
          type: array
          items:
            required:
              - saved_object_id
              - id
            type: object
            properties:
              created_at:
                type: string
                format: date-time
              created_by:
                type:
                  - 'null'
                  - string
              created_by_profile_uid:
                type: string
              description:
                $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
              ecs_mapping:
                $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
              id:
                $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
              interval:
                type:
                  - integer
                  - string
              platform:
                $ref: '#/components/schemas/Security_Osquery_API_Platform'
              prebuilt:
                type: boolean
              query:
                $ref: '#/components/schemas/Security_Osquery_API_Query'
              removed:
                $ref: '#/components/schemas/Security_Osquery_API_Removed'
              saved_object_id:
                type: string
              snapshot:
                $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
              timeout:
                type: integer
              updated_at:
                type: string
                format: date-time
              updated_by:
                type:
                  - 'null'
                  - string
              updated_by_profile_uid:
                type: string
              version:
                type:
                  - integer
                  - string
          description: An array of saved query objects.
        page:
          type: integer
          description: The current page number.
        per_page:
          type: integer
          description: The number of results per page.
        total:
          type: integer
          description: The total number of saved queries.
      description: A paginated list of saved queries.
      example:
        data:
          - created_at: '2022-07-26T09:28:08.597Z'
            created_by: elastic
            created_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            description: Saved query description
            ecs_mapping:
              host.uptime:
                field: total_seconds
            id: saved_query_id
            interval: '60'
            platform: 'linux,darwin'
            prebuilt: false
            query: select * from uptime;
            saved_object_id: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
            updated_at: '2022-07-26T09:28:08.597Z'
            updated_by: elastic
            updated_by_profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            version: '2.8.0'
        page: 1
        per_page: 100
        total: 11
    Security_Osquery_API_GetLiveQueryResultsResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            edges:
              type: array
              items:
                type: object
                properties:
                  _id:
                    type: string
                  _source:
                    type: object
                    description: The Elasticsearch document source containing query results.
              description: The result rows from the query execution.
            total:
              type: integer
              description: The total number of result rows.
      description: The response for getting live query results.
      example:
        data:
          edges:
            - _id: doc1
              _source: { }
            - _id: doc2
              _source: { }
          total: 2
    Security_Osquery_API_GetScheduledActionResultsResponse:
      type: object
      properties:
        aggregations:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduledActionResultsAggregations'
        currentPage:
          type: integer
          description: The current page number (zero-based).
        edges:
          type: array
          items:
            type: object
          description: The paginated list of per-agent action results.
        inspect:
          type: object
          description: Debug/inspection data for the search query.
        metadata:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduledExecutionMetadata'
        pageSize:
          type: integer
          description: The number of results per page.
        total:
          type: integer
          description: The total number of action results.
        totalPages:
          type: integer
          description: The total number of pages.
      example:
        aggregations:
          failed: 1
          pending: 0
          successful: 9
          totalResponded: 10
          totalRowCount: 42
        currentPage: 0
        edges:
          - _id: result-001
            fields:
              agent_id: 16d7caf5-efd2-4212-9b62-73dafc91fa13
              rows_count: 5
              status: success
        metadata:
          executionCount: 3
          packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
          packName: My Pack
          queryName: uptime
          queryText: select * from uptime;
          scheduleId: pack_my_pack_uptime
          timestamp: '2024-07-26T09:00:00.000Z'
        pageSize: 20
        total: 10
        totalPages: 1
    Security_Osquery_API_GetScheduledQueryResultsResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            edges:
              type: array
              items:
                type: object
              description: The paginated list of query result rows.
            inspect:
              type: object
              description: Debug/inspection data for the search query.
            total:
              type: integer
              description: The total number of result rows.
          description: The query results data wrapper.
      description: The response for getting scheduled query results.
      example:
        data:
          edges:
            - _id: row-001
              fields:
                host.uptime:
                  - '12345'
            - _id: row-002
              fields:
                host.uptime:
                  - '67890'
          total: 2
    Security_Osquery_API_GetUnifiedHistoryResponse:
      required:
        - data
        - hasMore
      type: object
      properties:
        data:
          type: array
          items:
            $ref: '#/components/schemas/Security_Osquery_API_UnifiedHistoryRow'
          description: The list of unified history rows for the current page.
        hasMore:
          type: boolean
          description: Whether there are more results beyond the current page.
        nextPage:
          type: string
          description: A base64-encoded cursor to fetch the next page. Absent when there are no more results.
      example:
        data:
          - actionId: 609c4c66-ba3d-43fa-afdd-53e244577aa0
            agentCount: 5
            errorCount: 0
            id: 3c42c847-eb30-4452-80e0-728584042334
            queryName: uptime_query
            queryText: select * from uptime;
            source: Live
            sourceType: live
            successCount: 5
            timestamp: '2024-07-26T09:59:32.220Z'
            totalRows: 42
            userId: elastic
          - agentCount: 10
            errorCount: 1
            executionCount: 3
            id: pack_my_pack_uptime_3
            packId: 42ba9c50-0cc5-11ed-aa1d-2b27890bc90d
            packName: My Pack
            plannedTime: '2024-07-26T09:00:00.000Z'
            queryName: uptime
            queryText: select * from uptime;
            scheduleId: pack_my_pack_uptime
            source: Scheduled
            sourceType: scheduled
            successCount: 9
            timestamp: '2024-07-26T09:00:00.000Z'
            totalRows: 100
        hasMore: true
        nextPage: eyJhY3Rpb25TZWFyY2hBZnRlciI6WzE3...
    Security_Osquery_API_Interval:
      type: string
      description: 'An interval, in seconds, on which to run the query.'
      example: '60'
    Security_Osquery_API_IntervalOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Interval'
    Security_Osquery_API_KueryOrUndefined:
      type:
        - 'null'
        - string
      description: The kuery to filter the results by.
      example: 'agent.id: 16d7caf5-efd2-4212-9b62-73dafc91fa13'
    Security_Osquery_API_LiveHistoryRow:
      allOf:
        - $ref: '#/components/schemas/Security_Osquery_API_UnifiedHistoryRowBase'
        - required:
            - sourceType
            - source
          type: object
          properties:
            actionId:
              type: string
              description: The Fleet action ID for the live query.
            agentAll:
              type: boolean
              description: Whether the query targeted all agents.
            agentIds:
              type: array
              items:
                type: string
              description: List of targeted agent IDs.
            agentPlatforms:
              type: array
              items:
                type: string
              description: List of targeted agent platforms.
            agentPolicyIds:
              type: array
              items:
                type: string
              description: List of targeted agent policy IDs.
            ecsMapping:
              type: object
              description: ECS mapping configuration used for the query.
            queriesTotal:
              type: integer
              description: The total number of sub-queries in the live action.
            queriesWithResults:
              type: integer
              description: The number of sub-queries that returned results.
            savedQueryId:
              type: string
              description: 'The saved query ID, if the live query was based on a saved query.'
            source:
              enum:
                - Live
                - Rule
              type: string
              description: Whether this was a manually run live query or triggered by a rule.
            sourceType:
              enum:
                - live
              type: string
              description: Identifies this as a live query history row.
            timeout:
              type: integer
              description: The query timeout in seconds.
            userId:
              type: string
              description: The ID of the user who ran the query.
            userProfileUid:
              type: string
              description: The user profile UID of the user who ran the query.
    Security_Osquery_API_MinOsqueryVersion:
      maxLength: 64
      minLength: 1
      type: string
      description: 'Minimum osquery version required to run this pack or query. Formatted as a semver string, e.g. `"5.10.0"`.'
      example: '5.10.0'
    Security_Osquery_API_MinOsqueryVersionOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
    Security_Osquery_API_ObjectQueries:
      type: object
      additionalProperties:
        $ref: '#/components/schemas/Security_Osquery_API_ObjectQueriesItem'
      description: An object of queries.
    Security_Osquery_API_ObjectQueriesItem:
      type: object
      properties:
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        enabled:
          $ref: '#/components/schemas/Security_Osquery_API_QueryEnabled'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_QueryId'
        interval:
          type:
            - 'null'
            - integer
          description: "Interval for this query, in seconds. Overrides the pack's `interval` when this query also has `schedule_type: interval`. If you send `interval` without `schedule_type: interval`, Kibana removes it when saving, and the query uses the pack's `interval` instead. Ignored when the pack's `schedule_type` is `rrule`.\n"
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        result_type:
          $ref: '#/components/schemas/Security_Osquery_API_ResultType'
        rrule_schedule:
          $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
        saved_query_id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
        schedule_type:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Osquery_API_PackDescription:
      type: string
      description: The pack description.
      example: Pack description
    Security_Osquery_API_PackDescriptionOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
    Security_Osquery_API_PackId:
      type: string
      description: The ID of the pack.
      example: 3c42c847-eb30-4452-80e0-728584042334
    Security_Osquery_API_PackIdOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_PackId'
    Security_Osquery_API_PackInterval:
      minimum: 1
      type: integer
      description: 'Pack-level interval, in seconds. Used when `schedule_type` is `interval`. Mutually exclusive with `rrule_schedule`.'
      example: 60
    Security_Osquery_API_PackIntervalOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
    Security_Osquery_API_PackName:
      type: string
      description: The pack name.
      example: my_pack
    Security_Osquery_API_PackPlatform:
      maxLength: 256
      minLength: 1
      type: string
      description: 'Pack-level platform restriction. To specify multiple platforms, use commas. For example, `linux,darwin`.'
      example: 'linux,darwin'
    Security_Osquery_API_PackPlatformOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
    Security_Osquery_API_PageOrUndefined:
      type:
        - 'null'
        - integer
      description: The page number to return. The default is 1.
      example: 1
    Security_Osquery_API_PageSizeOrUndefined:
      type:
        - 'null'
        - integer
      description: The number of results to return per page. The default is 20.
      example: 20
    Security_Osquery_API_Platform:
      type: string
      description: 'Restricts the query to a specified platform. The default is all platforms. To specify multiple platforms, use commas. For example, `linux,darwin`.'
      example: 'linux,darwin'
    Security_Osquery_API_PlatformOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Platform'
    Security_Osquery_API_PolicyIds:
      type: array
      items:
        type: string
      description: A list of agents policy IDs.
      example:
        - policyId1
        - policyId2
    Security_Osquery_API_PolicyIdsOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
    Security_Osquery_API_Query:
      type: string
      description: The SQL query you want to run.
      example: select * from uptime;
    Security_Osquery_API_QueryEnabled:
      type: boolean
      description: 'Whether this query is enabled. When false, the query is omitted from the Fleet policy. Default is true.'
      example: true
    Security_Osquery_API_QueryId:
      type: string
      description: The ID of the query.
      example: 3c42c847-eb30-4452-80e0-728584042334
    Security_Osquery_API_QueryOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Query'
    Security_Osquery_API_Removed:
      type: boolean
      description: Indicates whether the query is removed.
      example: false
    Security_Osquery_API_RemovedOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Removed'
    Security_Osquery_API_ResultType:
      enum:
        - snapshot
        - differential
        - differential_added_only
      type: string
      description: "Controls the result document type emitted by osquerybeat for this pack or query.\n- `snapshot`: Full table snapshot on every scheduled run (default).\n- `differential`: Rows added or removed since the previous run.\n- `differential_added_only`: Only rows added since the previous run (no removals).\n"
    Security_Osquery_API_ResultTypeOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_ResultType'
    Security_Osquery_API_RRuleScheduleConfig:
      required:
        - rrule
        - start_date
      type: object
      properties:
        end_date:
          maxLength: 64
          type: string
          description: Optional RFC 3339 datetime string for the schedule's end. MUST be after `start_date`.
          format: date-time
          example: '2024-12-31T23:59:59Z'
        rrule:
          maxLength: 2048
          type: string
          description: "Fully serialized RFC 5545 RRULE string (e.g.\n`\"FREQ=WEEKLY;BYDAY=MO,WE,FR\"`). The Kibana UI writes only a\nsubset of parts — `FREQ`, `INTERVAL`, `BYDAY`, `BYMONTHDAY`,\n`BYMONTH` — but the server accepts and round-trips any\nwell-formed parts (other recognized parts like `BYHOUR`,\n`BYMINUTE`, `BYSETPOS`, `WKST`, `COUNT`, `UNTIL` are preserved\nverbatim).\n"
          example: 'FREQ=WEEKLY;BYDAY=MO,WE,FR'
        splay:
          maxLength: 64
          type: string
          description: "Optional Go duration string for splay (random execution delay),\ne.g. `\"30s\"`, `\"5m\"`, `\"1h\"`. The Kibana form writes single-unit\nvalues only; compound durations (`\"1h30m\"`) are tolerated on\nread for round-trip safety with osquerybeat's writer. Maximum\n12 hours (43200 seconds).\n"
          example: 5m
        start_date:
          maxLength: 64
          type: string
          description: RFC 3339 datetime string for the schedule's start.
          format: date-time
          example: '2024-01-01T00:00:00Z'
        timeout:
          type: number
          description: 'Optional query execution timeout, in seconds. Defaults to 60 in osquerybeat when unset.'
          example: 60
      description: "RRULE schedule configuration consumed by osquerybeat. Loose date\nforms like `\"2024-01-01\"` are rejected with 400. DTSTART is NOT\nembedded in `rrule`; the separate `start_date` field is the\nschedule anchor.\n"
    Security_Osquery_API_RRuleScheduleConfigOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
    Security_Osquery_API_SavedQueryDescription:
      type: string
      description: The saved query description.
      example: Saved query description
    Security_Osquery_API_SavedQueryDescriptionOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
    Security_Osquery_API_SavedQueryId:
      type: string
      description: The ID of a saved query.
      example: 3c42c847-eb30-4452-80e0-728584042334
    Security_Osquery_API_SavedQueryIdOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
    Security_Osquery_API_ScheduledActionResultsAggregations:
      type: object
      properties:
        failed:
          type: integer
          description: The number of agents that returned errors.
        pending:
          type: integer
          description: The number of agents with pending responses.
        successful:
          type: integer
          description: The number of agents that completed successfully.
        totalResponded:
          type: integer
          description: The total number of agents that responded.
        totalRowCount:
          type: integer
          description: The total number of result rows across all agents.
    Security_Osquery_API_ScheduledExecutionMetadata:
      type: object
      properties:
        executionCount:
          type: integer
          description: The execution count for this scheduled query run.
        packId:
          type: string
          description: The ID of the pack containing the query.
        packName:
          type: string
          description: The name of the pack containing the query.
        queryName:
          type: string
          description: The name of the query within the pack.
        queryText:
          type: string
          description: The SQL query that was executed.
        scheduleId:
          type: string
          description: The schedule ID for the scheduled query.
        timestamp:
          type: string
          description: The timestamp of the most recent response for this execution.
      description: Execution metadata resolved from the pack saved object.
    Security_Osquery_API_ScheduledHistoryRow:
      allOf:
        - $ref: '#/components/schemas/Security_Osquery_API_UnifiedHistoryRowBase'
        - required:
            - sourceType
            - source
          type: object
          properties:
            executionCount:
              type: integer
              description: The execution count for this scheduled query run.
            plannedTime:
              type: string
              description: The planned execution time for the scheduled query.
            scheduleId:
              type: string
              description: The schedule ID for the scheduled query.
            source:
              enum:
                - Scheduled
              type: string
              description: Indicates this is a scheduled query execution.
            sourceType:
              enum:
                - scheduled
              type: string
              description: Identifies this as a scheduled query history row.
    Security_Osquery_API_ScheduleType:
      enum:
        - interval
        - rrule
      type: string
      description: "Discriminator for the pack's schedule mode. `interval` uses native\nosqueryd interval scheduling (seconds). `rrule` uses osquerybeat's\nRRULE-based recurrence scheduling. Per-query overrides MUST use the\nsame mode as the pack — cross-mode overrides are rejected with 400.\n"
      example: rrule
    Security_Osquery_API_ScheduleTypeOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
    Security_Osquery_API_Shards:
      type: object
      additionalProperties:
        type: number
      description: 'An object with shard configuration for policies included in the pack. For each policy, set the shard configuration to a percentage (1–100) of target hosts.'
      example:
        policy_id: 50
    Security_Osquery_API_Snapshot:
      type: boolean
      description: Indicates whether the query is a snapshot.
      example: true
    Security_Osquery_API_SnapshotOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
    Security_Osquery_API_SortOrderOrUndefined:
      enum:
        - asc
        - desc
      type: string
      description: Specifies the sort order.
      example: desc
    Security_Osquery_API_SortOrUndefined:
      type:
        - 'null'
        - string
      description: The field that is used to sort the results.
      default: createdAt
      example: createdAt
    Security_Osquery_API_UnifiedHistoryRow:
      oneOf:
        - $ref: '#/components/schemas/Security_Osquery_API_LiveHistoryRow'
        - $ref: '#/components/schemas/Security_Osquery_API_ScheduledHistoryRow'
      discriminator:
        propertyName: sourceType
        mapping:
          live: '#/components/schemas/Security_Osquery_API_LiveHistoryRow'
          scheduled: '#/components/schemas/Security_Osquery_API_ScheduledHistoryRow'
    Security_Osquery_API_UnifiedHistoryRowBase:
      required:
        - id
        - timestamp
        - queryText
        - agentCount
      type: object
      properties:
        agentCount:
          type: integer
          description: 'For live queries, the number of agents targeted by the query. For scheduled rows, the number of distinct agents that responded.'
        errorCount:
          type:
            - 'null'
            - integer
          description: The number of agent responses with errors.
        id:
          type: string
          description: Unique identifier for the history row.
        packId:
          type: string
          description: The ID of the pack containing the query.
        packName:
          type: string
          description: The name of the pack containing the query.
        queryName:
          type: string
          description: 'The name of the query, if available.'
        queryText:
          type: string
          description: The SQL query that was executed.
        spaceId:
          type: string
          description: The Kibana space ID where the query was executed.
        successCount:
          type:
            - 'null'
            - integer
          description: The number of successful agent responses.
        timestamp:
          type: string
          description: The timestamp of the query execution.
        totalRows:
          type:
            - 'null'
            - integer
          description: The total number of result rows returned across all agents.
    Security_Osquery_API_UpdatePacksRequestBody:
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
        enabled:
          $ref: '#/components/schemas/Security_Osquery_API_Enabled'
        interval:
          $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
        min_osquery_version:
          $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
        name:
          $ref: '#/components/schemas/Security_Osquery_API_PackName'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
        policy_ids:
          $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
        queries:
          $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
        result_type:
          $ref: '#/components/schemas/Security_Osquery_API_ResultType'
        rrule_schedule:
          $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
        schedule_type:
          $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
        shards:
          $ref: '#/components/schemas/Security_Osquery_API_Shards'
      example:
        name: updated_my_pack_name
    Security_Osquery_API_UpdatePacksResponse:
      type: object
      properties:
        data:
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_PackDescription'
            enabled:
              $ref: '#/components/schemas/Security_Osquery_API_Enabled'
            interval:
              $ref: '#/components/schemas/Security_Osquery_API_PackInterval'
            min_osquery_version:
              $ref: '#/components/schemas/Security_Osquery_API_MinOsqueryVersion'
            name:
              $ref: '#/components/schemas/Security_Osquery_API_PackName'
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_PackPlatform'
            policy_ids:
              $ref: '#/components/schemas/Security_Osquery_API_PolicyIds'
            queries:
              $ref: '#/components/schemas/Security_Osquery_API_ObjectQueries'
            result_type:
              $ref: '#/components/schemas/Security_Osquery_API_ResultType'
            rrule_schedule:
              $ref: '#/components/schemas/Security_Osquery_API_RRuleScheduleConfig'
            saved_object_id:
              type: string
              description: The saved object ID of the pack.
            schedule_type:
              $ref: '#/components/schemas/Security_Osquery_API_ScheduleType'
            shards:
              $ref: '#/components/schemas/Security_Osquery_API_Shards'
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
            version:
              type: integer
              description: The pack version number.
      description: The response for updating a pack.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: My pack
          enabled: true
          name: updated_my_pack_name
          policy_ids:
            - my_policy_id
          queries:
            ports:
              ecs_mapping:
                client.port:
                  field: port
              interval: 60
              query: SELECT * FROM listening_ports;
              removed: false
              snapshot: true
              timeout: 120
          saved_object_id: 1c266590-381f-428c-878f-c80c1334f856
          shards:
            47638692-7c4c-4053-aa3e-7186f28df349: 35
            5e267651-fe50-443e-8d3f-3bbc9171b618: 58
          updated_at: '2025-02-26T13:40:16.297Z'
          updated_by: elastic
          version: 1
    Security_Osquery_API_UpdateSavedQueryRequestBody:
      type: object
      properties:
        description:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
        ecs_mapping:
          $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
        id:
          $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
        interval:
          $ref: '#/components/schemas/Security_Osquery_API_Interval'
        platform:
          $ref: '#/components/schemas/Security_Osquery_API_Platform'
        query:
          $ref: '#/components/schemas/Security_Osquery_API_Query'
        removed:
          $ref: '#/components/schemas/Security_Osquery_API_Removed'
        snapshot:
          $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
        version:
          $ref: '#/components/schemas/Security_Osquery_API_Version'
      example:
        id: updated_my_saved_query_name
    Security_Osquery_API_UpdateSavedQueryResponse:
      required:
        - data
      type: object
      properties:
        data:
          required:
            - saved_object_id
            - id
          type: object
          properties:
            created_at:
              type: string
              format: date-time
            created_by:
              type:
                - 'null'
                - string
            created_by_profile_uid:
              type: string
            description:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryDescription'
            ecs_mapping:
              $ref: '#/components/schemas/Security_Osquery_API_ECSMapping'
            id:
              $ref: '#/components/schemas/Security_Osquery_API_SavedQueryId'
            interval:
              type:
                - integer
                - string
            platform:
              $ref: '#/components/schemas/Security_Osquery_API_Platform'
            prebuilt:
              type: boolean
            query:
              $ref: '#/components/schemas/Security_Osquery_API_Query'
            removed:
              $ref: '#/components/schemas/Security_Osquery_API_Removed'
            saved_object_id:
              type: string
            snapshot:
              $ref: '#/components/schemas/Security_Osquery_API_Snapshot'
            timeout:
              type: integer
            updated_at:
              type: string
              format: date-time
            updated_by:
              type:
                - 'null'
                - string
            updated_by_profile_uid:
              type: string
            version:
              type: string
              description: The saved query version.
      description: The response for updating a saved query.
      example:
        data:
          created_at: '2025-02-26T13:37:30.452Z'
          created_by: elastic
          description: Saved query description
          id: updated_my_saved_query_name
          interval: '60'
          query: select * from uptime;
          saved_object_id: 42ba1280-2172-11ee-8523-5765fca79a3c
          updated_at: '2025-02-26T13:40:16.297Z'
          updated_by: elastic
          version: WzQzMTcsMV0=
    Security_Osquery_API_Version:
      type: string
      description: Uses the Osquery versions greater than or equal to the specified version string.
      example: 1.0.0
    Security_Osquery_API_VersionOrUndefined:
      $ref: '#/components/schemas/Security_Osquery_API_Version'
    Security_Solution_Initialization_API_CreateListIndicesReadyResult:
      required:
        - status
      type: object
      properties:
        status:
          enum:
            - ready
          type: string
    Security_Solution_Initialization_API_DataViewPayload:
      required:
        - id
        - title
        - patternList
      type: object
      properties:
        id:
          type: string
        patternList:
          type: array
          items:
            type: string
        title:
          type: string
    Security_Solution_Initialization_API_InitializationFlowErrorResult:
      required:
        - status
        - error
      type: object
      properties:
        error:
          type:
            - 'null'
            - string
        status:
          enum:
            - error
          type: string
    Security_Solution_Initialization_API_InitializationFlowId:
      enum:
        - create-list-indices
        - security-data-views
        - init-prebuilt-rules
        - init-endpoint-protection
        - init-ai-prompts
        - init-detection-rule-monitoring
      type: string
      description: Identifier for an initialization flow.
    Security_Solution_Initialization_API_InitializationFlowsResult:
      type: object
      properties:
        create-list-indices:
          oneOf:
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_CreateListIndicesReadyResult'
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult'
        init-ai-prompts:
          oneOf:
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_PackageInstallReadyResult'
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult'
        init-detection-rule-monitoring:
          oneOf:
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InstallDetectionEngineRuleMonitoringAssetsReadyResult'
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult'
        init-endpoint-protection:
          oneOf:
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_PackageInstallReadyResult'
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult'
        init-prebuilt-rules:
          oneOf:
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_PackageInstallReadyResult'
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult'
        security-data-views:
          oneOf:
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_SecurityDataViewsReadyResult'
            - $ref: '#/components/schemas/Security_Solution_Initialization_API_InitializationFlowErrorResult'
      description: 'Per-flow results. Only requested flows appear in the response, so all properties are optional. Each flow is either a typed ready result or an error result.'
    Security_Solution_Initialization_API_InstallDetectionEngineRuleMonitoringAssetsReadyResult:
      required:
        - status
      type: object
      properties:
        status:
          enum:
            - ready
          type: string
    Security_Solution_Initialization_API_PackageInstallReadyResult:
      required:
        - status
        - payload
      type: object
      properties:
        payload:
          required:
            - name
            - version
            - install_status
          type: object
          properties:
            install_status:
              type: string
              description: 'Fleet package installation status (e.g., installed, already_installed).'
            name:
              type: string
            version:
              type: string
        status:
          enum:
            - ready
          type: string
    Security_Solution_Initialization_API_SecurityDataViewsReadyResult:
      required:
        - status
        - payload
      type: object
      properties:
        payload:
          required:
            - defaultDataView
            - alertDataView
            - kibanaDataViews
            - signalIndexName
          type: object
          properties:
            alertDataView:
              $ref: '#/components/schemas/Security_Solution_Initialization_API_DataViewPayload'
            attackDataView:
              $ref: '#/components/schemas/Security_Solution_Initialization_API_DataViewPayload'
            defaultDataView:
              $ref: '#/components/schemas/Security_Solution_Initialization_API_DataViewPayload'
            kibanaDataViews:
              type: array
              items:
                $ref: '#/components/schemas/Security_Solution_Initialization_API_DataViewPayload'
            signalIndexName:
              type: string
        status:
          enum:
            - ready
          type: string
    Security_Timeline_API_AssociatedFilterType:
      enum:
        - all
        - document_only
        - saved_object_only
        - document_and_saved_object
        - orphan
      type: string
      description: "How the note is associated with a Timeline saved object and/or an event (`eventId`). `all`: no association-based restriction from this parameter. `document_only`: document-linked notes (non-empty `eventId`) without timeline association in the API's internal sense; post-filtering drops notes without a usable `eventId`. `saved_object_only`: timeline notes with no linked event (`eventId` empty or absent); post-filtering keeps timeline-only notes. `document_and_saved_object`: notes on a timeline and linked to an event; post-filtering enforces a real `eventId`. `orphan`: not on a timeline and `eventId` is empty (stricter than missing `eventId` in some cases).\n"
    Security_Timeline_API_BareNote:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_NoteCreatedAndUpdatedMetadata'
        - required:
            - timelineId
          type: object
          properties:
            eventId:
              type:
                - 'null'
                - string
              description: "Elasticsearch document `_id` for the event or alert this note refers to. Same value as the `documentIds` query parameter when fetching notes via GET /api/note.\n"
              example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
            note:
              type:
                - 'null'
                - string
              description: The text of the note
              example: This is an example text
            timelineId:
              type: string
              description: The `savedObjectId` of the Timeline this note belongs to (not the note's own ID).
              example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
    Security_Timeline_API_BarePinnedEvent:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata'
        - required:
            - eventId
            - timelineId
          type: object
          properties:
            eventId:
              type: string
              description: The `_id` of the associated event for this pinned event.
              example: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bc
            timelineId:
              type: string
              description: The `savedObjectId` of the timeline that this pinned event is associated with
              example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
    Security_Timeline_API_ColumnHeaderResult:
      type: object
      properties:
        aggregatable:
          type:
            - 'null'
            - boolean
        category:
          type:
            - 'null'
            - string
        columnHeaderType:
          type:
            - 'null'
            - string
        description:
          type:
            - 'null'
            - string
        example:
          type:
            - 'null'
            - string
        id:
          type:
            - 'null'
            - string
        indexes:
          type:
            - 'null'
            - array
          items:
            type: string
        name:
          type:
            - 'null'
            - string
        placeholder:
          type:
            - 'null'
            - string
        searchable:
          type:
            - 'null'
            - boolean
        type:
          type:
            - 'null'
            - string
    Security_Timeline_API_DataProviderQueryMatch:
      type: object
      properties:
        enabled:
          type:
            - 'null'
            - boolean
        excluded:
          type:
            - 'null'
            - boolean
        id:
          type:
            - 'null'
            - string
        kqlQuery:
          type:
            - 'null'
            - string
        name:
          type:
            - 'null'
            - string
        queryMatch:
          $ref: '#/components/schemas/Security_Timeline_API_QueryMatchResult'
        type:
          $ref: '#/components/schemas/Security_Timeline_API_DataProviderType'
    Security_Timeline_API_DataProviderResult:
      type: object
      properties:
        and:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_DataProviderQueryMatch'
        enabled:
          type:
            - 'null'
            - boolean
        excluded:
          type:
            - 'null'
            - boolean
        id:
          type:
            - 'null'
            - string
        kqlQuery:
          type:
            - 'null'
            - string
        name:
          type:
            - 'null'
            - string
        queryMatch:
          $ref: '#/components/schemas/Security_Timeline_API_QueryMatchResult'
        type:
          $ref: '#/components/schemas/Security_Timeline_API_DataProviderType'
    Security_Timeline_API_DataProviderType:
      enum:
        - default
        - template
      type: string
      description: The type of data provider.
    Security_Timeline_API_DocumentIds:
      oneOf:
        - type: array
          items:
            type: string
        - type: string
      description: One document ID or an array of IDs (Elasticsearch `_id` of the event).
    Security_Timeline_API_FavoriteTimelineResponse:
      required:
        - savedObjectId
        - version
      type: object
      properties:
        favorite:
          type: array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResult'
        savedObjectId:
          type: string
        templateTimelineId:
          type:
            - 'null'
            - string
        templateTimelineVersion:
          type:
            - 'null'
            - number
        timelineType:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
        version:
          type: string
    Security_Timeline_API_FavoriteTimelineResult:
      type: object
      properties:
        favoriteDate:
          type:
            - 'null'
            - number
        fullName:
          type:
            - 'null'
            - string
        userName:
          type:
            - 'null'
            - string
      description: Indicates when and who marked a Timeline as a favorite.
      example:
        favoriteDate: 1741337636741
        userName: elastic
    Security_Timeline_API_FilterTimelineResult:
      type: object
      properties:
        exists:
          type:
            - 'null'
            - string
        match_all:
          type:
            - 'null'
            - string
        meta:
          type:
            - 'null'
            - object
          properties:
            alias:
              type:
                - 'null'
                - string
            controlledBy:
              type:
                - 'null'
                - string
            disabled:
              type:
                - 'null'
                - boolean
            field:
              type:
                - 'null'
                - string
            formattedValue:
              type:
                - 'null'
                - string
            index:
              type:
                - 'null'
                - string
            key:
              type:
                - 'null'
                - string
            negate:
              type:
                - 'null'
                - boolean
            params:
              type:
                - 'null'
                - string
            type:
              type:
                - 'null'
                - string
            value:
              type:
                - 'null'
                - string
        missing:
          type:
            - 'null'
            - string
        query:
          type:
            - 'null'
            - string
        range:
          type:
            - 'null'
            - string
        script:
          type:
            - 'null'
            - string
      example:
        meta:
          alias: Custom filter name
          disabled: false
          index: '.alerts-security.alerts-default,logs-*'
          key: '@timestamp'
          negate: 'false,'
          type: exists
          value: exists
        query: '{"exists":{"field":"@timestamp"}}'
    Security_Timeline_API_GetNotesResult:
      required:
        - totalCount
        - notes
      type: object
      properties:
        notes:
          type: array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_Note'
        totalCount:
          type: number
          description: Number of notes returned (may be adjusted after the query when `associatedFilter` applies post-filtering).
    Security_Timeline_API_ImportTimelineResult:
      type: object
      properties:
        errors:
          type: array
          items:
            type: object
            properties:
              error:
                type: object
                properties:
                  message:
                    type: string
                    description: The reason why the timeline could not be imported
                    example: Malformed JSON
                  status_code:
                    type: number
                    description: The HTTP status code of the error
                    example: 400
                description: The error containing the reason why the timeline could not be imported
              id:
                type: string
                description: The ID of the timeline that failed to import
                example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
          description: The list of failed Timeline imports
        success:
          type: boolean
          description: Indicates whether any of the Timelines were successfully imports
        success_count:
          type: number
          description: The amount of successfully imported/updated Timelines
          example: 99
        timelines_installed:
          type: number
          description: The amount of successfully installed Timelines
          example: 80
        timelines_updated:
          type: number
          description: The amount of successfully updated Timelines
          example: 19
    Security_Timeline_API_ImportTimelines:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
        - required:
            - savedObjectId
            - version
            - pinnedEventIds
            - eventNotes
            - globalNotes
          type: object
          properties:
            eventNotes:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_BareNote'
            globalNotes:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_BareNote'
            pinnedEventIds:
              type:
                - 'null'
                - array
              items:
                type: string
            savedObjectId:
              type:
                - 'null'
                - string
            version:
              type:
                - 'null'
                - string
    Security_Timeline_API_Note:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_BareNote'
        - required:
            - noteId
            - version
          type: object
          properties:
            noteId:
              type: string
              description: The `savedObjectId` of the note
              example: 709f99c6-89b6-4953-9160-35945c8e174e
            version:
              type: string
              description: The version of the note
              example: WzQ2LDFd
    Security_Timeline_API_NoteCreatedAndUpdatedMetadata:
      type: object
      properties:
        created:
          type:
            - 'null'
            - number
          description: 'The time the note was created, using a 13-digit Epoch timestamp.'
          example: 1587468588922
        createdBy:
          type:
            - 'null'
            - string
          description: The user who created the note.
          example: casetester
        updated:
          type:
            - 'null'
            - number
          description: 'The last time the note was updated, using a 13-digit Epoch timestamp'
          example: 1741344876825
        updatedBy:
          type:
            - 'null'
            - string
          description: The user who last updated the note
          example: casetester
    Security_Timeline_API_PersistPinnedEventResponse:
      oneOf:
        - $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
        - required:
            - unpinned
          type: object
          properties:
            unpinned:
              type: boolean
              description: Indicates whether the event was successfully unpinned
    Security_Timeline_API_PersistTimelineResponse:
      $ref: '#/components/schemas/Security_Timeline_API_TimelineResponse'
    Security_Timeline_API_PinnedEvent:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_BarePinnedEvent'
        - required:
            - pinnedEventId
            - version
          type: object
          properties:
            pinnedEventId:
              type: string
              description: The `savedObjectId` of this pinned event
              example: 10r1929b-0af7-42bd-85a8-56e234f98h2f3
            version:
              type: string
              description: The version of this pinned event
              example: WzQ2LDFe
    Security_Timeline_API_PinnedEventCreatedAndUpdatedMetadata:
      type: object
      properties:
        created:
          type:
            - 'null'
            - number
          description: 'The time the pinned event was created, using a 13-digit Epoch timestamp.'
          example: 1587468588922
        createdBy:
          type:
            - 'null'
            - string
          description: The user who created the pinned event.
          example: casetester
        updated:
          type:
            - 'null'
            - number
          description: 'The last time the pinned event was updated, using a 13-digit Epoch timestamp'
          example: 1741344876825
        updatedBy:
          type:
            - 'null'
            - string
          description: The user who last updated the pinned event
          example: casetester
    Security_Timeline_API_QueryMatchResult:
      type: object
      properties:
        displayField:
          type:
            - 'null'
            - string
        displayValue:
          type:
            - 'null'
            - string
        field:
          type:
            - 'null'
            - string
        operator:
          type:
            - 'null'
            - string
        value:
          oneOf:
            - type:
                - 'null'
                - string
            - type:
                - 'null'
                - array
              items:
                type: string
    Security_Timeline_API_ResolvedTimeline:
      required:
        - timeline
        - outcome
      type: object
      properties:
        alias_purpose:
          $ref: '#/components/schemas/Security_Timeline_API_SavedObjectResolveAliasPurpose'
        alias_target_id:
          type: string
        outcome:
          $ref: '#/components/schemas/Security_Timeline_API_SavedObjectResolveOutcome'
        timeline:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineSavedToReturnObject'
    Security_Timeline_API_ResponseNote:
      required:
        - note
      type: object
      properties:
        note:
          $ref: '#/components/schemas/Security_Timeline_API_Note'
    Security_Timeline_API_RowRendererId:
      enum:
        - alert
        - alerts
        - auditd
        - auditd_file
        - library
        - netflow
        - plain
        - registry
        - suricata
        - system
        - system_dns
        - system_endgame_process
        - system_file
        - system_fim
        - system_security_event
        - system_socket
        - threat_match
        - zeek
      type: string
      description: Identifies the available row renderers
    Security_Timeline_API_SavedObjectIds:
      oneOf:
        - type: array
          items:
            type: string
        - type: string
      description: One Timeline saved object ID or an array of IDs.
    Security_Timeline_API_SavedObjectResolveAliasPurpose:
      enum:
        - savedObjectConversion
        - savedObjectImport
      type: string
    Security_Timeline_API_SavedObjectResolveOutcome:
      enum:
        - exactMatch
        - aliasMatch
        - conflict
      type: string
    Security_Timeline_API_SavedTimeline:
      type: object
      properties:
        columns:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_ColumnHeaderResult'
          description: The Timeline's columns
          example:
            - columnHeaderType: not-filtered
              id: '@timestamp'
            - columnHeaderType: not-filtered
              id: event.category
        created:
          type:
            - 'null'
            - number
          description: 'The time the Timeline was created, using a 13-digit Epoch timestamp.'
          example: 1587468588922
        createdBy:
          type:
            - 'null'
            - string
          description: The user who created the Timeline.
          example: casetester
        dataProviders:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_DataProviderResult'
          description: Object containing query clauses
          example:
            - enabled: true
              excluded: false
              id: id-d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
              name: d3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b
              queryMatch:
                field: '_id,'
                operator: ':'
                value: 'd3a1d35a3e84a81b2f8f3859e064c224cdee1b4bcbf66f57d124dcc739c98e6b,'
        dataViewId:
          type:
            - 'null'
            - string
          description: ID of the Timeline's Data View
          example: security-solution-default
        dateRange:
          type:
            - 'null'
            - object
          properties:
            end:
              oneOf:
                - type:
                    - 'null'
                    - string
                - type:
                    - 'null'
                    - number
            start:
              oneOf:
                - type:
                    - 'null'
                    - string
                - type:
                    - 'null'
                    - number
          description: The Timeline's search period.
          example:
            end: 1587456479201
            start: 1587370079200
        description:
          type:
            - 'null'
            - string
          description: The Timeline's description
          example: Investigating exposure of CVE XYZ
        eqlOptions:
          type:
            - 'null'
            - object
          properties:
            eventCategoryField:
              type:
                - 'null'
                - string
            query:
              type:
                - 'null'
                - string
            size:
              oneOf:
                - type:
                    - 'null'
                    - string
                - type:
                    - 'null'
                    - number
            tiebreakerField:
              type:
                - 'null'
                - string
            timestampField:
              type:
                - 'null'
                - string
          description: EQL query that is used in the correlation tab
          example:
            eventCategoryField: event.category
            query: 'sequence\n[process where process.name == "sudo"]\n[any where true]'
            size: 100
            timestampField: '@timestamp'
        eventType:
          type:
            - 'null'
            - string
          description: Event types displayed in the Timeline
          example: all
          deprecated: true
        excludedRowRendererIds:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_RowRendererId'
          description: A list of row renderers that should not be used when in `Event renderers` mode
        favorite:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_FavoriteTimelineResult'
        filters:
          type:
            - 'null'
            - array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_FilterTimelineResult'
          description: A list of filters that should be applied to the query
        indexNames:
          type:
            - 'null'
            - array
          items:
            type: string
          description: A list of index names to use in the query (e.g. when the default data view has been modified)
          example:
            - .logs*
        kqlMode:
          type:
            - 'null'
            - string
          description: "Indicates whether the KQL bar filters the query results or searches for additional results, where:\n  * `filter`: filters query results\n  * `search`: displays additional search results"
          example: search
        kqlQuery:
          $ref: '#/components/schemas/Security_Timeline_API_SerializedFilterQueryResult'
        savedQueryId:
          type:
            - 'null'
            - string
          description: The ID of the saved query that might be used in the Query tab
          example: c7b16904-02d7-4f32-b8f2-cc20f9625d6e
        savedSearchId:
          type:
            - 'null'
            - string
          description: The ID of the saved search that is used in the ES|QL tab
          example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
        sort:
          $ref: '#/components/schemas/Security_Timeline_API_Sort'
        status:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineStatus'
        templateTimelineId:
          type:
            - 'null'
            - string
          description: 'A unique ID (UUID) for Timeline templates. For Timelines, the value is `null`.'
          example: 6ce1b592-84e3-4b4a-9552-f189d4b82075
        templateTimelineVersion:
          type:
            - 'null'
            - number
          description: 'Timeline template version number. For Timelines, the value is `null`.'
          example: 12
        timelineType:
          $ref: '#/components/schemas/Security_Timeline_API_TimelineType'
        title:
          type:
            - 'null'
            - string
          description: The Timeline's title.
          example: CVE XYZ investigation
        updated:
          type:
            - 'null'
            - number
          description: 'The last time the Timeline was updated, using a 13-digit Epoch timestamp'
          example: 1741344876825
        updatedBy:
          type:
            - 'null'
            - string
          description: The user who last updated the Timeline
          example: casetester
    Security_Timeline_API_SavedTimelineWithSavedObjectId:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
        - required:
            - savedObjectId
            - version
          type: object
          properties:
            savedObjectId:
              type: string
              description: The `savedObjectId` of the Timeline or Timeline template
              example: 15c1929b-0af7-42bd-85a8-56e234cc7c4e
            version:
              type: string
              description: The version of the Timeline or Timeline template
              example: WzE0LDFd
    Security_Timeline_API_SerializedFilterQueryResult:
      type: object
      properties:
        filterQuery:
          type:
            - 'null'
            - object
          properties:
            kuery:
              type:
                - 'null'
                - object
              properties:
                expression:
                  type:
                    - 'null'
                    - string
                kind:
                  type:
                    - 'null'
                    - string
            serializedQuery:
              type:
                - 'null'
                - string
      description: KQL bar query.
      example:
        filterQuery: 'null'
        kuery:
          expression: '_id : *'
          kind: kuery
        serializedQuery: '{"bool":{"should":[{"exists":{"field":"_id"}}],"minimum_should_match":1}}'
    Security_Timeline_API_Sort:
      oneOf:
        - $ref: '#/components/schemas/Security_Timeline_API_SortObject'
        - type: array
          items:
            $ref: '#/components/schemas/Security_Timeline_API_SortObject'
    Security_Timeline_API_SortFieldTimeline:
      enum:
        - title
        - description
        - updated
        - created
      type: string
      description: The field to sort the timelines by.
    Security_Timeline_API_SortObject:
      type: object
      properties:
        columnId:
          type:
            - 'null'
            - string
        columnType:
          type:
            - 'null'
            - string
        sortDirection:
          type:
            - 'null'
            - string
      description: Object indicating how rows are sorted in the Timeline's grid
      example:
        columnId: '@timestamp'
        sortDirection: desc
    Security_Timeline_API_TimelineResponse:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
        - $ref: '#/components/schemas/Security_Timeline_API_SavedTimelineWithSavedObjectId'
        - type: object
          properties:
            eventIdToNoteIds:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_Note'
              description: A list of all the notes that are associated to this Timeline.
            noteIds:
              type:
                - 'null'
                - array
              items:
                type: string
              description: A list of all the ids of notes that are associated to this Timeline.
              example:
                - 709f99c6-89b6-4953-9160-35945c8e174e
            notes:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_Note'
              description: A list of all the notes that are associated to this Timeline.
            pinnedEventIds:
              type:
                - 'null'
                - array
              items:
                type: string
              description: A list of all the ids of pinned events that are associated to this Timeline.
              example:
                - 983f99c6-89b6-4953-9160-35945c8a194f
            pinnedEventsSaveObject:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
              description: A list of all the pinned events that are associated to this Timeline.
    Security_Timeline_API_TimelineSavedToReturnObject:
      allOf:
        - $ref: '#/components/schemas/Security_Timeline_API_SavedTimeline'
        - required:
            - savedObjectId
            - version
          type: object
          properties:
            eventIdToNoteIds:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_Note'
            noteIds:
              type:
                - 'null'
                - array
              items:
                type: string
            notes:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_Note'
            pinnedEventIds:
              type:
                - 'null'
                - array
              items:
                type: string
            pinnedEventsSaveObject:
              type:
                - 'null'
                - array
              items:
                $ref: '#/components/schemas/Security_Timeline_API_PinnedEvent'
            savedObjectId:
              type: string
            version:
              type: string
    Security_Timeline_API_TimelineStatus:
      enum:
        - active
        - draft
        - immutable
      type: string
      description: The status of the Timeline.
    Security_Timeline_API_TimelineType:
      enum:
        - default
        - template
      type: string
      description: The type of Timeline.
    Short_URL_APIs_urlResponse:
      type: object
      properties:
        accessCount:
          type: integer
          description: Number of times the short URL has been resolved.
        accessDate:
          type: integer
          description: Unix epoch (milliseconds) of the last time the short URL was resolved. Set to the creation time when the URL has never been accessed.
          format: int64
        createDate:
          type: integer
          description: Unix epoch (milliseconds) when the short URL was created.
          format: int64
        id:
          type: string
          description: The identifier for the short URL.
        locator:
          type: object
          properties:
            id:
              type: string
              description: The identifier for the locator.
            state:
              type: object
              description: The locator parameters.
            version:
              type: string
              description: The version of Kibana when the short URL was created.
        slug:
          type: string
          description: "A random human-readable slug is automatically generated if the `humanReadableSlug` parameter is set to `true`. If it is set to `false`, a random short string is generated.\n"
    SLOs_400_response:
      title: Bad request
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          example: Bad Request
        message:
          type: string
          example: 'Invalid value ''foo'' supplied to: [...]'
        statusCode:
          type: number
          example: 400
    SLOs_401_response:
      title: Unauthorized
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          example: Unauthorized
        message:
          type: string
          example: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [elastics] for REST request [/_security/_authenticate]]: unable to authenticate user [elastics] for REST request [/_security/_authenticate]"
        statusCode:
          type: number
          example: 401
    SLOs_403_response:
      title: Forbidden
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          example: Forbidden
        message:
          type: string
          example: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: action [slo_write] is unauthorized for user [limited_user] for REST request [/api/observability/slos]]: action [slo_write] is unauthorized for user [limited_user]"
        statusCode:
          type: number
          example: 403
    SLOs_404_response:
      title: Not found
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          example: Not Found
        message:
          type: string
          example: 'SLO [3749f390-03a3-11ee-8139-c7ff60a1692d] not found'
        statusCode:
          type: number
          example: 404
    SLOs_409_response:
      title: Conflict
      required:
        - statusCode
        - error
        - message
      type: object
      properties:
        error:
          type: string
          example: Conflict
        message:
          type: string
          example: 'SLO [d077e940-1515-11ee-9c50-9d096392f520] already exists'
        statusCode:
          type: number
          example: 409
    SLOs_artifacts:
      title: Artifacts
      type: object
      properties:
        dashboards:
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
                description: Dashboard saved-object id
          description: Array of dashboard references
      description: Links to related assets for the SLO
    SLOs_budgeting_method:
      title: Budgeting method
      enum:
        - occurrences
        - timeslices
      type: string
      description: The budgeting method to use when computing the rollup data.
      example: occurrences
    SLOs_bulk_delete_request:
      title: Bulk delete SLO request
      required:
        - list
      type: object
      properties:
        list:
          type: array
          items:
            type: string
            description: The SLO Definition id
            example: 8853df00-ae2e-11ed-90af-09bb6422b258
          description: An array of SLO Definition id
      description: "The bulk delete SLO request takes a list of SLOs Definition id to delete.\n"
    SLOs_bulk_delete_response:
      title: Bulk delete SLO response
      type: object
      properties:
        taskId:
          type: string
          description: The taskId of the bulk delete operation
          example: d08506b7-f0e8-4f8b-a06a-a83940f4db91
      description: "The bulk delete SLO response returns a taskId that can be used to poll for its status\n"
    SLOs_bulk_delete_status_response:
      title: The status of the bulk deletion
      type: object
      properties:
        error:
          type: string
          description: The error message if the bulk deletion operation failed
          example: Task not found
        isDone:
          type: boolean
          description: Indicates if the bulk deletion operation is completed
          example: true
        results:
          type: array
          items:
            type: object
            properties:
              error:
                type: string
                description: The error message if the deletion operation failed for this SLO
                example: 'SLO [d08506b7-f0e8-4f8b-a06a-a83940f4db91] not found'
              id:
                type: string
                description: The ID of the SLO that was deleted
                example: d08506b7-f0e8-4f8b-a06a-a83940f4db91
              success:
                type: boolean
                description: The result of the deletion operation for this SLO
                example: true
          description: 'The results of the bulk deletion operation, including the success status and any errors for each SLO'
      description: 'Indicates if the bulk deletion is completed, with the detailed results of the operation.'
    SLOs_bulk_purge_rollup_request:
      title: Bulk Purge Rollup data request
      required:
        - list
        - purgePolicy
      type: object
      properties:
        list:
          type: array
          items:
            type: string
            description: The SLO Definition id
            example: 8853df00-ae2e-11ed-90af-09bb6422b258
          description: An array of slo ids
        purgePolicy:
          type: object
          oneOf:
            - type: object
              properties:
                age:
                  type: string
                  description: 'The duration to determine which documents to purge, formatted as {duration}{unit}. This value should be greater than or equal to the time window of every SLO provided.'
                  example: 7d
                purgeType:
                  enum:
                    - fixed-age
                  type: string
                  description: Specifies whether documents will be purged based on a specific age or on a timestamp
            - type: object
              properties:
                purgeType:
                  enum:
                    - fixed-time
                  type: string
                  description: Specifies whether documents will be purged based on a specific age or on a timestamp
                timestamp:
                  type: string
                  description: 'The timestamp to determine which documents to purge, formatted in ISO. This value should be older than the applicable time window of every SLO provided.'
                  example: '2024-12-31T00:00:00.000Z'
          description: Policy that dictates which SLI documents to purge based on age
      description: "The bulk purge rollup data request takes a list of SLO ids and a purge policy, then deletes the rollup data according to the purge policy. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n"
    SLOs_bulk_purge_rollup_response:
      title: Bulk Purge Rollup data response
      type: object
      properties:
        taskId:
          type: string
          description: The task id of the purge operation
          example: 8853df00-ae2e-11ed-90af-09bb6422b258
      description: "The bulk purge rollup data response returns a task id from the elasticsearch deleteByQuery response.\n"
    SLOs_bulk_snapshot_request:
      title: Bulk snapshot SLO request
      required:
        - at
        - requests
      type: object
      properties:
        at:
          type: string
          description: The point in time at which to compute the SLO instance summaries
          format: date-time
          example: '2025-01-12T10:00:00.000Z'
        requests:
          maxItems: 100
          type: array
          items:
            required:
              - id
            type: object
            properties:
              id:
                type: string
                description: The SLO definition id
                example: 8853df00-ae2e-11ed-90af-09bb6422b258
              instanceId:
                type: string
                description: "The SLO instance ID. Omit this parameter or set it to `'*'` to return all instances for the SLO (up to 1000). Set a specific value to return that instance only.\n"
                example: '*'
          description: The list of SLO instances to compute. Limited to 100 entries.
      description: "The bulk snapshot SLO request takes a point in time and a list of SLO instances to compute summaries for. The list is limited to 100 entries.\n"
    SLOs_create_slo_request:
      title: Create SLO request
      required:
        - name
        - description
        - indicator
        - timeWindow
        - budgetingMethod
        - objective
      type: object
      properties:
        artifacts:
          $ref: '#/components/schemas/SLOs_artifacts'
        budgetingMethod:
          $ref: '#/components/schemas/SLOs_budgeting_method'
        description:
          type: string
          description: A description for the SLO.
        groupBy:
          $ref: '#/components/schemas/SLOs_group_by'
        id:
          type: string
          description: A optional and unique identifier for the SLO. Must be between 8 and 48 chars
          example: my-super-slo-id
        indicator:
          oneOf:
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
            - $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
            - $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
        name:
          type: string
          description: A name for the SLO.
        objective:
          $ref: '#/components/schemas/SLOs_objective'
        settings:
          $ref: '#/components/schemas/SLOs_settings'
        tags:
          type: array
          items:
            type: string
          description: List of tags
        timeWindow:
          $ref: '#/components/schemas/SLOs_time_window'
      description: "The create SLO API request body varies depending on the type of indicator, time window and budgeting method.\n"
    SLOs_create_slo_response:
      title: Create SLO response
      required:
        - id
      type: object
      properties:
        id:
          type: string
          example: 8853df00-ae2e-11ed-90af-09bb6422b258
    SLOs_delete_slo_instances_request:
      title: Delete SLO instances request
      required:
        - list
      type: object
      properties:
        list:
          type: array
          items:
            required:
              - sloId
              - instanceId
            type: object
            properties:
              instanceId:
                type: string
                description: The SLO instance identifier
                example: 8853df00-ae2e-11ed-90af-09bb6422b258
              sloId:
                type: string
                description: The SLO unique identifier
                example: 8853df00-ae2e-11ed-90af-09bb6422b258
          description: An array of slo id and instance id
      description: "The delete SLO instances request takes a list of SLO id and instance id, then delete the rollup and summary data. This API can be used to remove the staled data of an instance SLO that no longer get updated.\n"
    SLOs_error_budget:
      title: Error budget
      required:
        - initial
        - consumed
        - remaining
        - isEstimated
      type: object
      properties:
        consumed:
          type: number
          description: 'The error budget consummed, as a percentage of the initial value.'
          example: 0.8
        initial:
          type: number
          description: 'The initial error budget, as 1 - objective'
          example: 0.02
        isEstimated:
          type: boolean
          description: Only for SLO defined with occurrences budgeting method and calendar aligned time window.
          example: true
        remaining:
          type: number
          description: 'The error budget remaining, as a percentage of the initial value.'
          example: 0.2
    SLOs_filter:
      title: Filter
      type: object
      properties:
        meta:
          $ref: '#/components/schemas/SLOs_filter_meta'
        query:
          type: object
      description: Defines properties for a filter
    SLOs_filter_meta:
      title: FilterMeta
      type: object
      properties:
        alias:
          type:
            - 'null'
            - string
        controlledBy:
          type: string
        disabled:
          type: boolean
        field:
          type: string
        group:
          type: string
        index:
          type: string
        isMultiIndex:
          type: boolean
        key:
          type: string
        negate:
          type: boolean
        params:
          type: object
        type:
          type: string
        value:
          type: string
      description: Defines properties for a filter
    SLOs_find_slo_definitions_response:
      title: Find SLO definitions response
      type: object
      oneOf:
        - type: object
          properties:
            page:
              type: number
              example: 1
            perPage:
              type: number
              example: 25
            results:
              type: array
              items:
                $ref: '#/components/schemas/SLOs_slo_with_summary_response'
            total:
              type: number
              example: 34
        - type: object
          properties:
            page:
              type: number
              description: for backward compability
              default: 1
            perPage:
              type: number
              description: for backward compability
              example: 25
            results:
              type: array
              items:
                $ref: '#/components/schemas/SLOs_slo_with_summary_response'
            searchAfter:
              type: array
              items:
                type: string
              description: the cursor to provide to get the next paged results
              example:
                - some-slo-id
                - other-cursor-id
            size:
              type: number
              example: 25
            total:
              type: number
              example: 34
      description: "A paginated response of SLO definitions matching the query.\n"
    SLOs_find_slo_response:
      title: Find SLO response
      type: object
      properties:
        page:
          type: number
          example: 1
        perPage:
          type: number
          example: 25
        results:
          type: array
          items:
            $ref: '#/components/schemas/SLOs_slo_with_summary_response'
        searchAfter:
          type: string
        size:
          type: number
          description: Size provided for cursor based pagination
          example: 25
        total:
          type: number
          example: 34
      description: "A paginated response of SLOs matching the query.\n"
    SLOs_group_by:
      title: Group by
      oneOf:
        - type: string
        - type: array
          items:
            type: string
      description: optional group by field or fields to use to generate an SLO per distinct value
      example:
        - 
          - service.name
        - service.name
        - 
          - service.name
          - service.environment
    SLOs_indicator_properties_apm_availability:
      title: APM availability
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - service
            - environment
            - transactionType
            - transactionName
            - index
          type: object
          properties:
            environment:
              type: string
              description: The APM service environment or "*"
              example: production
            filter:
              type: string
              description: KQL query used for filtering the data
              example: 'service.foo : "bar"'
            index:
              type: string
              description: The index used by APM metrics
              example: 'metrics-apm*,apm*'
            service:
              type: string
              description: The APM service name
              example: o11y-app
            transactionName:
              type: string
              description: The APM transaction name or "*"
              example: GET /my/api
            transactionType:
              type: string
              description: The APM transaction type or "*"
              example: request
          description: An object containing the indicator parameters.
        type:
          type: string
          description: The type of indicator.
          example: sli.apm.transactionDuration
      description: Defines properties for the APM availability indicator type
    SLOs_indicator_properties_apm_latency:
      title: APM latency
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - service
            - environment
            - transactionType
            - transactionName
            - index
            - threshold
          type: object
          properties:
            environment:
              type: string
              description: The APM service environment or "*"
              example: production
            filter:
              type: string
              description: KQL query used for filtering the data
              example: 'service.foo : "bar"'
            index:
              type: string
              description: The index used by APM metrics
              example: 'metrics-apm*,apm*'
            service:
              type: string
              description: The APM service name
              example: o11y-app
            threshold:
              type: number
              description: The latency threshold in milliseconds
              example: 250
            transactionName:
              type: string
              description: The APM transaction name or "*"
              example: GET /my/api
            transactionType:
              type: string
              description: The APM transaction type or "*"
              example: request
          description: An object containing the indicator parameters.
        type:
          type: string
          description: The type of indicator.
          example: sli.apm.transactionDuration
      description: Defines properties for the APM latency indicator type
    SLOs_indicator_properties_custom_kql:
      title: Custom Query
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - index
            - timestampField
            - good
            - total
          type: object
          properties:
            dataViewId:
              type: string
              description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
              example: 03b80ab3-003d-498b-881c-3beedbaf1162
            filter:
              $ref: '#/components/schemas/SLOs_kql_with_filters'
            good:
              $ref: '#/components/schemas/SLOs_kql_with_filters_good'
            index:
              type: string
              description: The index or index pattern to use
              example: my-service-*
            timestampField:
              type: string
              description: "The timestamp field used in the source indice.\n"
              example: timestamp
            total:
              $ref: '#/components/schemas/SLOs_kql_with_filters_total'
          description: An object containing the indicator parameters.
        type:
          type: string
          description: The type of indicator.
          example: sli.kql.custom
      description: Defines properties for a custom query indicator type
    SLOs_indicator_properties_custom_metric:
      title: Custom metric
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - index
            - timestampField
            - good
            - total
          type: object
          properties:
            dataViewId:
              type: string
              description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
              example: 03b80ab3-003d-498b-881c-3beedbaf1162
            filter:
              type: string
              description: the KQL query to filter the documents with.
              example: 'field.environment : "production" and service.name : "my-service"'
            good:
              required:
                - metrics
                - equation
              type: object
              properties:
                equation:
                  type: string
                  description: The equation to calculate the "good" metric.
                  example: A
                metrics:
                  type: array
                  items:
                    oneOf:
                      - required:
                          - name
                          - aggregation
                          - field
                        type: object
                        properties:
                          aggregation:
                            enum:
                              - sum
                            type: string
                            description: The aggregation type of the metric.
                            example: sum
                          field:
                            type: string
                            description: The field of the metric.
                            example: processor.processed
                          filter:
                            type: string
                            description: The filter to apply to the metric.
                            example: 'processor.outcome: *'
                          name:
                            pattern: '^[A-Z]$'
                            type: string
                            description: The name of the metric. Only valid options are A-Z
                            example: A
                      - required:
                          - name
                          - aggregation
                        type: object
                        properties:
                          aggregation:
                            enum:
                              - doc_count
                            type: string
                            description: The aggregation type of the metric.
                            example: doc_count
                          filter:
                            type: string
                            description: The filter to apply to the metric.
                            example: 'processor.outcome: *'
                          name:
                            pattern: '^[A-Z]$'
                            type: string
                            description: The name of the metric. Only valid options are A-Z
                            example: A
                  description: 'List of metrics with their name, aggregation type, and field.'
              description: "An object defining the \"good\" metrics and equation\n"
            index:
              type: string
              description: The index or index pattern to use
              example: my-service-*
            timestampField:
              type: string
              description: "The timestamp field used in the source indice.\n"
              example: timestamp
            total:
              required:
                - metrics
                - equation
              type: object
              properties:
                equation:
                  type: string
                  description: The equation to calculate the "total" metric.
                  example: A
                metrics:
                  type: array
                  items:
                    oneOf:
                      - required:
                          - name
                          - aggregation
                          - field
                        type: object
                        properties:
                          aggregation:
                            enum:
                              - sum
                            type: string
                            description: The aggregation type of the metric.
                            example: sum
                          field:
                            type: string
                            description: The field of the metric.
                            example: processor.processed
                          filter:
                            type: string
                            description: The filter to apply to the metric.
                            example: 'processor.outcome: *'
                          name:
                            pattern: '^[A-Z]$'
                            type: string
                            description: The name of the metric. Only valid options are A-Z
                            example: A
                      - required:
                          - name
                          - aggregation
                        type: object
                        properties:
                          aggregation:
                            enum:
                              - doc_count
                            type: string
                            description: The aggregation type of the metric.
                            example: doc_count
                          filter:
                            type: string
                            description: The filter to apply to the metric.
                            example: 'processor.outcome: *'
                          name:
                            pattern: '^[A-Z]$'
                            type: string
                            description: The name of the metric. Only valid options are A-Z
                            example: A
                  description: 'List of metrics with their name, aggregation type, and field.'
              description: "An object defining the \"total\" metrics and equation\n"
          description: An object containing the indicator parameters.
        type:
          type: string
          description: The type of indicator.
          example: sli.metric.custom
      description: Defines properties for a custom metric indicator type
    SLOs_indicator_properties_histogram:
      title: Histogram indicator
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - index
            - timestampField
            - good
            - total
          type: object
          properties:
            dataViewId:
              type: string
              description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
              example: 03b80ab3-003d-498b-881c-3beedbaf1162
            filter:
              type: string
              description: the KQL query to filter the documents with.
              example: 'field.environment : "production" and service.name : "my-service"'
            good:
              required:
                - aggregation
                - field
              type: object
              properties:
                aggregation:
                  enum:
                    - value_count
                    - range
                  type: string
                  description: The type of aggregation to use.
                  example: value_count
                field:
                  type: string
                  description: The field use to aggregate the good events.
                  example: processor.latency
                filter:
                  type: string
                  description: The filter for good events.
                  example: 'processor.outcome: "success"'
                from:
                  type: number
                  description: The starting value of the range. Only required for "range" aggregations.
                  example: 0
                to:
                  type: number
                  description: The ending value of the range. Only required for "range" aggregations.
                  example: 100
              description: "An object defining the \"good\" events\n"
            index:
              type: string
              description: The index or index pattern to use
              example: my-service-*
            timestampField:
              type: string
              description: "The timestamp field used in the source indice.\n"
              example: timestamp
            total:
              required:
                - aggregation
                - field
              type: object
              properties:
                aggregation:
                  enum:
                    - value_count
                    - range
                  type: string
                  description: The type of aggregation to use.
                  example: value_count
                field:
                  type: string
                  description: The field use to aggregate the good events.
                  example: processor.latency
                filter:
                  type: string
                  description: The filter for total events.
                  example: 'processor.outcome : *'
                from:
                  type: number
                  description: The starting value of the range. Only required for "range" aggregations.
                  example: 0
                to:
                  type: number
                  description: The ending value of the range. Only required for "range" aggregations.
                  example: 100
              description: "An object defining the \"total\" events\n"
          description: An object containing the indicator parameters.
        type:
          type: string
          description: The type of indicator.
          example: sli.histogram.custom
      description: Defines properties for a histogram indicator type
    SLOs_indicator_properties_timeslice_metric:
      title: Timeslice metric
      required:
        - type
        - params
      type: object
      properties:
        params:
          required:
            - index
            - timestampField
            - metric
          type: object
          properties:
            dataViewId:
              type: string
              description: 'The kibana data view id to use, primarily used to include data view runtime mappings. Make sure to save SLO again if you add/update run time fields to the data view and if those fields are being used in slo queries.'
              example: 03b80ab3-003d-498b-881c-3beedbaf1162
            filter:
              type: string
              description: the KQL query to filter the documents with.
              example: 'field.environment : "production" and service.name : "my-service"'
            index:
              type: string
              description: The index or index pattern to use
              example: my-service-*
            metric:
              required:
                - metrics
                - equation
                - comparator
                - threshold
              type: object
              properties:
                comparator:
                  enum:
                    - GT
                    - GTE
                    - LT
                    - LTE
                  type: string
                  description: The comparator to use to compare the equation to the threshold.
                  example: GT
                equation:
                  type: string
                  description: The equation to calculate the metric.
                  example: A
                metrics:
                  type: array
                  items:
                    anyOf:
                      - $ref: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                      - $ref: '#/components/schemas/SLOs_timeslice_metric_percentile_metric'
                      - $ref: '#/components/schemas/SLOs_timeslice_metric_doc_count_metric'
                    discriminator:
                      propertyName: aggregation
                      mapping:
                        avg: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                        cardinality: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                        doc_count: '#/components/schemas/SLOs_timeslice_metric_doc_count_metric'
                        last_value: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                        max: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                        min: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                        percentile: '#/components/schemas/SLOs_timeslice_metric_percentile_metric'
                        std_deviation: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                        sum: '#/components/schemas/SLOs_timeslice_metric_basic_metric_with_field'
                  description: 'List of metrics with their name, aggregation type, and field.'
                threshold:
                  type: number
                  description: The threshold used to determine if the metric is a good slice or not.
                  example: 100
              description: "An object defining the metrics, equation, and threshold to determine if it's a good slice or not\n"
            timestampField:
              type: string
              description: "The timestamp field used in the source indice.\n"
              example: timestamp
          description: An object containing the indicator parameters.
        type:
          type: string
          description: The type of indicator.
          example: sli.metric.timeslice
      description: Defines properties for a timeslice metric indicator type
    SLOs_kql_with_filters:
      title: KQL with filters
      oneOf:
        - type: string
          description: the KQL query to filter the documents with.
          example: 'field.environment : "production" and service.name : "my-service"'
        - type: object
          properties:
            filters:
              type: array
              items:
                $ref: '#/components/schemas/SLOs_filter'
            kqlQuery:
              type: string
      description: Defines properties for a filter
    SLOs_kql_with_filters_good:
      title: KQL query for good events
      oneOf:
        - type: string
          description: the KQL query to filter the documents with.
          example: 'request.latency <= 150 and request.status_code : "2xx"'
        - type: object
          properties:
            filters:
              type: array
              items:
                $ref: '#/components/schemas/SLOs_filter'
            kqlQuery:
              type: string
      description: The KQL query used to define the good events.
    SLOs_kql_with_filters_total:
      title: KQL query for all events
      oneOf:
        - type: string
          description: the KQL query to filter the documents with.
          example: 'field.environment : "production" and service.name : "my-service"'
        - type: object
          properties:
            filters:
              type: array
              items:
                $ref: '#/components/schemas/SLOs_filter'
            kqlQuery:
              type: string
      description: The KQL query used to define all events.
    SLOs_objective:
      title: Objective
      required:
        - target
      type: object
      properties:
        target:
          exclusiveMaximum: 100
          exclusiveMinimum: 0
          type: number
          description: the target objective between 0 and 1 excluded
          example: 0.99
        timesliceTarget:
          maximum: 100
          minimum: 0
          type: number
          description: the target objective for each slice when using a timeslices budgeting method
          example: 0.995
        timesliceWindow:
          type: string
          description: 'the duration of each slice when using a timeslices budgeting method, as {duraton}{unit}'
          example: 5m
      description: Defines properties for the SLO objective
    SLOs_settings:
      title: Settings
      type: object
      properties:
        frequency:
          type: string
          description: The interval between checks for changes in the source data. The minimum value is 1m and the maximum is 59m. The default value is 1 minute.
          default: 1m
          example: 5m
        preventCrossProjectSearch:
          type: boolean
          description: 'Pin the L1 rollup transform to the local/origin project only, preventing flat-world (cross-linked-project) reads. Only applies on serverless. Default is false, meaning rollup transforms target all linked projects.'
          default: false
          example: true
          deprecated: true
        preventInitialBackfill:
          type: boolean
          description: 'Start aggregating data from the time the SLO is created, instead of backfilling data from the beginning of the time window.'
          default: false
          example: true
        projectRoutings:
          maxLength: 8192
          type:
            - 'null'
            - string
          description: 'ES ProjectRouting expression controlling which linked projects the L1 rollup reads. When set (including null), overrides preventCrossProjectSearch. null and `_alias:_origin` mean origin only; `_alias:*` means all linked projects. Subset example `_id:p1 AND _id:p2`.'
          example: _alias:_origin
        syncDelay:
          type: string
          description: The time delay in minutes between the current time and the latest source data time. Increasing the value will delay any alerting. The default value is 1 minute. The minimum value is 1m and the maximum is 359m. It should always be greater then source index refresh interval.
          default: 1m
          example: 5m
        syncField:
          type: string
          description: 'The date field that is used to identify new documents in the source. It is strongly recommended to use a field that contains the ingest timestamp. If you use a different field, you might need to set the delay such that it accounts for data transmission delays. When unspecified, we use the indicator timestamp field.'
          example: event.ingested
      description: Defines properties for SLO settings.
    SLOs_slo_definition_response:
      title: SLO definition response
      required:
        - id
        - name
        - description
        - indicator
        - timeWindow
        - budgetingMethod
        - objective
        - settings
        - revision
        - enabled
        - groupBy
        - tags
        - createdAt
        - updatedAt
        - version
      type: object
      properties:
        artifacts:
          $ref: '#/components/schemas/SLOs_artifacts'
        budgetingMethod:
          $ref: '#/components/schemas/SLOs_budgeting_method'
        createdAt:
          type: string
          description: The creation date
          example: '2023-01-12T10:03:19.000Z'
        description:
          type: string
          description: The description of the SLO.
          example: My SLO description
        enabled:
          type: boolean
          description: Indicate if the SLO is enabled
          example: true
        groupBy:
          $ref: '#/components/schemas/SLOs_group_by'
        id:
          type: string
          description: The identifier of the SLO.
          example: 8853df00-ae2e-11ed-90af-09bb6422b258
        indicator:
          oneOf:
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
            - $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
            - $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
          discriminator:
            propertyName: type
            mapping:
              sli.apm.transactionDuration: '#/components/schemas/SLOs_indicator_properties_apm_latency'
              sli.apm.transactionErrorRate: '#/components/schemas/SLOs_indicator_properties_apm_availability'
              sli.histogram.custom: '#/components/schemas/SLOs_indicator_properties_histogram'
              sli.kql.custom: '#/components/schemas/SLOs_indicator_properties_custom_kql'
              sli.metric.custom: '#/components/schemas/SLOs_indicator_properties_custom_metric'
              sli.metric.timeslice: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
        name:
          type: string
          description: The name of the SLO.
          example: My Service SLO
        objective:
          $ref: '#/components/schemas/SLOs_objective'
        revision:
          type: number
          description: The SLO revision
          example: 2
        settings:
          $ref: '#/components/schemas/SLOs_settings'
        tags:
          type: array
          items:
            type: string
          description: List of tags
        timeWindow:
          $ref: '#/components/schemas/SLOs_time_window'
        updatedAt:
          type: string
          description: The last update date
          example: '2023-01-12T10:03:19.000Z'
        version:
          type: number
          description: The internal SLO version
          example: 2
    SLOs_slo_with_summary_response:
      title: SLO response
      required:
        - id
        - name
        - description
        - indicator
        - timeWindow
        - budgetingMethod
        - objective
        - settings
        - revision
        - summary
        - enabled
        - groupBy
        - instanceId
        - tags
        - createdAt
        - updatedAt
        - version
      type: object
      properties:
        budgetingMethod:
          $ref: '#/components/schemas/SLOs_budgeting_method'
        createdAt:
          type: string
          description: The creation date
          example: '2023-01-12T10:03:19.000Z'
        description:
          type: string
          description: The description of the SLO.
          example: My SLO description
        enabled:
          type: boolean
          description: Indicate if the SLO is enabled
          example: true
        groupBy:
          $ref: '#/components/schemas/SLOs_group_by'
        id:
          type: string
          description: The identifier of the SLO.
          example: 8853df00-ae2e-11ed-90af-09bb6422b258
        indicator:
          oneOf:
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
            - $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
            - $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
          discriminator:
            propertyName: type
            mapping:
              sli.apm.transactionDuration: '#/components/schemas/SLOs_indicator_properties_apm_latency'
              sli.apm.transactionErrorRate: '#/components/schemas/SLOs_indicator_properties_apm_availability'
              sli.histogram.custom: '#/components/schemas/SLOs_indicator_properties_histogram'
              sli.kql.custom: '#/components/schemas/SLOs_indicator_properties_custom_kql'
              sli.metric.custom: '#/components/schemas/SLOs_indicator_properties_custom_metric'
              sli.metric.timeslice: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
        instanceId:
          type: string
          description: 'the value derived from the groupBy field, if present, otherwise ''*'''
          example: host-abcde
        name:
          type: string
          description: The name of the SLO.
          example: My Service SLO
        objective:
          $ref: '#/components/schemas/SLOs_objective'
        revision:
          type: number
          description: The SLO revision
          example: 2
        settings:
          $ref: '#/components/schemas/SLOs_settings'
        summary:
          $ref: '#/components/schemas/SLOs_summary'
        tags:
          type: array
          items:
            type: string
          description: List of tags
        timeWindow:
          $ref: '#/components/schemas/SLOs_time_window'
        updatedAt:
          type: string
          description: The last update date
          example: '2023-01-12T10:03:19.000Z'
        version:
          type: number
          description: The internal SLO version
          example: 2
    SLOs_snapshot_response:
      title: Snapshot SLO response
      required:
        - at
        - results
      type: object
      properties:
        at:
          type: string
          description: The point in time at which the summaries were computed
          format: date-time
          example: '2025-01-12T10:00:00.000Z'
        results:
          type: array
          items:
            $ref: '#/components/schemas/SLOs_snapshot_result'
          description: The per-instance computation results
      description: "The snapshot SLO response returns the point in time and the per-instance results. Each result contains either a summary (success) or an error (per-instance failure).\n"
    SLOs_snapshot_result:
      title: Snapshot result
      required:
        - id
        - instanceId
      type: object
      properties:
        error:
          required:
            - statusCode
            - message
          type: object
          properties:
            message:
              type: string
              description: The error message
              example: 'SLO [8853df00-ae2e-11ed-90af-09bb6422b258] not found'
            statusCode:
              type: number
              description: The HTTP status code of the error
              example: 404
          description: Error information when the computation failed for this SLO instance. Present when the computation failed.
        id:
          type: string
          description: The SLO definition id
          example: 8853df00-ae2e-11ed-90af-09bb6422b258
        instanceId:
          type: string
          description: The SLO instance id. '*' represents the default (ungrouped) instance.
          example: '*'
        summary:
          required:
            - status
            - sliValue
            - errorBudget
            - good
            - total
          type: object
          properties:
            errorBudget:
              required:
                - initial
                - consumed
                - remaining
              type: object
              properties:
                consumed:
                  type:
                    - 'null'
                    - number
                  description: 'The error budget consumed, or null when no data is available'
                  example: 0.24
                initial:
                  type: number
                  description: 'The initial error budget, derived from the SLO objective'
                  example: 0.01
                remaining:
                  type:
                    - 'null'
                    - number
                  description: 'The error budget remaining, or null when no data is available'
                  example: 0.76
            good:
              type: number
              description: The number of good events
              example: 9976
            sliValue:
              type:
                - 'null'
                - number
              description: 'The SLI value at the requested point in time, or null when no data is available'
              example: 0.9976
            status:
              enum:
                - NO_DATA
                - HEALTHY
                - DEGRADING
                - VIOLATED
              type: string
              description: The SLO health status
              example: HEALTHY
            total:
              type: number
              description: The total number of events
              example: 10000
          description: The SLO instance summary at the requested point in time. Present when the computation succeeded.
      description: "The result of computing an SLO instance summary at a point in time. Contains either a summary (on success) or an error (on failure).\n"
    SLOs_summary:
      title: Summary
      required:
        - status
        - sliValue
        - errorBudget
      type: object
      properties:
        errorBudget:
          $ref: '#/components/schemas/SLOs_error_budget'
        sliValue:
          type: number
          example: 0.9836
        status:
          $ref: '#/components/schemas/SLOs_summary_status'
      description: The SLO computed data
    SLOs_summary_status:
      title: summary status
      enum:
        - NO_DATA
        - HEALTHY
        - DEGRADING
        - VIOLATED
      type: string
      example: HEALTHY
    SLOs_time_window:
      title: Time window
      required:
        - duration
        - type
      type: object
      properties:
        duration:
          type: string
          description: 'the duration formatted as {duration}{unit}. Accepted values for rolling: 7d, 30d, 90d. Accepted values for calendar aligned: 1w (weekly) or 1M (monthly)'
          example: 30d
        type:
          enum:
            - rolling
            - calendarAligned
          type: string
          description: Indicates weither the time window is a rolling or a calendar aligned time window.
          example: rolling
      description: Defines properties for the SLO time window
    SLOs_timeslice_metric_basic_metric_with_field:
      title: Timeslice Metric Basic Metric with Field
      required:
        - name
        - aggregation
        - field
      type: object
      properties:
        aggregation:
          enum:
            - sum
            - avg
            - min
            - max
            - std_deviation
            - last_value
            - cardinality
          type: string
          description: The aggregation type of the metric.
          example: sum
        field:
          type: string
          description: The field of the metric.
          example: processor.processed
        filter:
          type: string
          description: The filter to apply to the metric.
          example: 'processor.outcome: "success"'
        name:
          pattern: '^[A-Z]$'
          type: string
          description: The name of the metric. Only valid options are A-Z
          example: A
    SLOs_timeslice_metric_doc_count_metric:
      title: Timeslice Metric Doc Count Metric
      required:
        - name
        - aggregation
      type: object
      properties:
        aggregation:
          enum:
            - doc_count
          type: string
          description: The aggregation type of the metric. Only valid option is "doc_count"
          example: doc_count
        filter:
          type: string
          description: The filter to apply to the metric.
          example: 'processor.outcome: "success"'
        name:
          pattern: '^[A-Z]$'
          type: string
          description: The name of the metric. Only valid options are A-Z
          example: A
    SLOs_timeslice_metric_percentile_metric:
      title: Timeslice Metric Percentile Metric
      required:
        - name
        - aggregation
        - field
        - percentile
      type: object
      properties:
        aggregation:
          enum:
            - percentile
          type: string
          description: The aggregation type of the metric. Only valid option is "percentile"
          example: percentile
        field:
          type: string
          description: The field of the metric.
          example: processor.processed
        filter:
          type: string
          description: The filter to apply to the metric.
          example: 'processor.outcome: "success"'
        name:
          pattern: '^[A-Z]$'
          type: string
          description: The name of the metric. Only valid options are A-Z
          example: A
        percentile:
          type: number
          description: The percentile value.
          example: 95
    SLOs_update_slo_request:
      title: Update SLO request
      type: object
      properties:
        artifacts:
          $ref: '#/components/schemas/SLOs_artifacts'
        budgetingMethod:
          $ref: '#/components/schemas/SLOs_budgeting_method'
        description:
          type: string
          description: A description for the SLO.
        groupBy:
          $ref: '#/components/schemas/SLOs_group_by'
        indicator:
          oneOf:
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_kql'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_availability'
            - $ref: '#/components/schemas/SLOs_indicator_properties_apm_latency'
            - $ref: '#/components/schemas/SLOs_indicator_properties_custom_metric'
            - $ref: '#/components/schemas/SLOs_indicator_properties_histogram'
            - $ref: '#/components/schemas/SLOs_indicator_properties_timeslice_metric'
        name:
          type: string
          description: A name for the SLO.
        objective:
          $ref: '#/components/schemas/SLOs_objective'
        settings:
          $ref: '#/components/schemas/SLOs_settings'
        tags:
          type: array
          items:
            type: string
          description: List of tags
        timeWindow:
          $ref: '#/components/schemas/SLOs_time_window'
      description: "The update SLO API request body varies depending on the type of indicator, time window and budgeting method. Partial update is handled.\n"
    Synthetics_browserMonitorFields:
      title: Browser monitor fields
      allOf:
        - $ref: '#/components/schemas/Synthetics_commonMonitorFields'
        - required:
            - inline_script
            - type
          type: object
          properties:
            certificate_error_spki_allowlist:
              type: array
              items:
                type: string
              description: PEM certificates whose public keys (SPKI) are allowlisted so Chromium bypasses certificate errors for matching presented certificates. This does not add a CA to Chromium's trust store.
              default: [ ]
            ignore_https_errors:
              type: boolean
              description: Ignore HTTPS errors.
              default: false
            inline_script:
              type: string
              description: The inline script.
            playwright_options:
              type: object
              description: Playwright options.
            screenshots:
              enum:
                - on
                - off
                - only-on-failure
              type: string
              description: The screenshot option.
              default: on
            synthetics_args:
              type: array
              items:
                type: string
              description: Synthetics agent CLI arguments.
            type:
              enum:
                - browser
              type: string
              description: The monitor type.
    Synthetics_commonMonitorFields:
      title: Common monitor fields
      required:
        - name
      type: object
      properties:
        alert:
          type: object
          description: "The alert configuration. The default is `{ status: { enabled: true }, tls: { enabled: true } }`.\n"
        enabled:
          type: boolean
          description: Specify whether the monitor is enabled.
          default: true
        labels:
          type: object
          additionalProperties:
            type: string
          description: "Key-value pairs of labels to associate with the monitor. Labels can be used for filtering and grouping monitors.\n"
        locations:
          type: array
          items:
            type: string
          description: "The location to deploy the monitor.\nMonitors can be deployed in multiple locations so that you can detect differences in availability and response times across those locations.\nTo list available locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Management* and click *Create monitor*. Locations will be listed in *Locations*.\n"
          externalDocs:
            url: https://github.com/elastic/synthetics/blob/main/src/locations/public-locations.ts
        name:
          type: string
          description: The monitor name.
        namespace:
          type: string
          description: "The namespace field should be lowercase and not contain spaces. The namespace must not include any of the following characters: `*`, `\\`, `/`, `?`, `\"`, `<`, `>`, `|`, whitespace, `,`, `#`, `:`, or `-`.\n"
          default: default
        params:
          type: string
          description: The monitor parameters.
        private_locations:
          type: array
          items:
            type: string
          description: "The private locations to which the monitors will be deployed.\nThese private locations refer to locations hosted and managed by you, whereas `locations` are hosted by Elastic.\nYou can specify a private location using the location's name.\nTo list available private locations you can:\n\n- Run the `elastic-synthetics locations` command with the deployment's Kibana URL.\n- Go to *Synthetics > Settings* and click *Private locationsr*. Private locations will be listed in the table.\n\n> info\n> You can provide `locations` or `private_locations` or both. At least one is required.\n"
        retest_on_failure:
          type: boolean
          description: "Turn retesting for when a monitor fails on or off. By default, monitors are automatically retested if the monitor goes from \"up\" to \"down\". If the result of the retest is also \"down\", an error will be created and if configured, an alert sent. The monitor will then resume running according to the defined schedule. Using `retest_on_failure` can reduce noise related to transient problems.\n"
          default: true
        schedule:
          type: number
          description: "The monitor's schedule in minutes. Supported values are `1`, `3`, `5`, `10`, `15`, `30`, `60`, `120`, and `240`. The default value is `3` minutes for HTTP, TCP, and ICMP monitors. The default value is `10` minutes for Browser monitors.\n"
        service.name:
          type: string
          description: The APM service name.
        tags:
          type: array
          items:
            type: string
          description: An array of tags.
        timeout:
          type: number
          description: "The monitor timeout in seconds. The monitor will fail if it doesn't complete within this time.\n\nFor browser monitors, the minimum timeout is 30 seconds. Browser monitor timeouts are only applied when the monitor runs on private locations. If a browser monitor specifies a timeout but has no private locations configured, the timeout will have no effect and a warning will be returned in the response.\n"
          default: 16
    Synthetics_getParameterResponse:
      title: Get parameter response
      type: object
      properties:
        description:
          type: string
          description: "The description of the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
        id:
          type: string
          description: The unique identifier of the parameter.
        key:
          type: string
          description: The key of the parameter.
        namespaces:
          type: array
          items:
            type: string
          description: "The namespaces associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
        tags:
          type: array
          items:
            type: string
          description: "An array of tags associated with the parameter. It is included in the response if the user has read-only permissions to the Synthetics app.\n"
        value:
          type: string
          description: "The value associated with the parameter. It will be included in the response if the user has write permissions.  \n"
    Synthetics_getPrivateLocation:
      title: Post a private location
      type: object
      properties:
        agentPolicyId:
          type: string
          description: The ID of the agent policy associated with the private location.
        geo:
          required:
            - lat
            - lon
          type: object
          properties:
            lat:
              type: number
              description: The latitude of the location.
            lon:
              type: number
              description: The longitude of the location.
          description: Geographic coordinates (WGS84) for the location.
        id:
          type: string
          description: The unique identifier of the private location.
        isInvalid:
          type: boolean
          description: "Indicates whether the location is invalid. If `true`, the location is invalid, which means the agent policy associated with the location is deleted.\n"
        label:
          type: string
          description: A label for the private location.
        namespace:
          type: string
          description: 'The namespace of the location, which is the same as the namespace of the agent policy associated with the location.'
    Synthetics_httpMonitorFields:
      title: HTTP monitor fields
      allOf:
        - $ref: '#/components/schemas/Synthetics_commonMonitorFields'
        - required:
            - type
            - url
          type: object
          properties:
            check:
              type: object
              properties:
                request:
                  type: object
                  properties:
                    body:
                      type: string
                      description: Optional request body content.
                    headers:
                      type: object
                      description: "A dictionary of additional HTTP headers to send. By default, Synthetics will set the User-Agent header to identify itself.\n"
                    method:
                      enum:
                        - HEAD
                        - GET
                        - POST
                        - OPTIONS
                      type: string
                      description: The HTTP method to use.
                  description: An optional request to send to the remote host.
                response:
                  type: object
                  properties:
                    body:
                      type: object
                    headers:
                      type: object
                      description: 'A dictionary of expected HTTP headers. If the header is not found, the check fails.'
                  description: The expected response.
              description: The check request settings.
            ipv4:
              type: boolean
              description: 'If `true`, ping using the ipv4 protocol.'
              default: true
            ipv6:
              type: boolean
              description: 'If `true`, ping using the ipv6 protocol.'
              default: true
            max_redirects:
              type: number
              description: The maximum number of redirects to follow.
              default: 0
            mode:
              enum:
                - all
                - any
              type: string
              description: "The mode of the monitor. If it is `all`, the monitor pings all resolvable IPs for a hostname. If it is `any`, the monitor pings only one IP address for a hostname. If you're using a DNS-load balancer and want to ping every IP address for the specified hostname, you should use `all`.\n"
              default: any
            password:
              type: string
              description: "The password for authenticating with the server. The credentials are passed with the request.\n"
            proxy_headers:
              type: object
              description: Additional headers to send to proxies during CONNECT requests.
            proxy_url:
              type: string
              description: The URL of the proxy to use for this monitor.
            response:
              type: object
              description: Controls the indexing of the HTTP response body contents to the `http.response.body.contents field`.
            ssl:
              type: object
              description: "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n"
            type:
              enum:
                - http
              type: string
              description: The monitor type.
            url:
              type: string
              description: The URL to monitor.
            username:
              type: string
              description: "The username for authenticating with the server. The credentials are passed with the request.\n"
    Synthetics_icmpMonitorFields:
      title: ICMP monitor fields
      allOf:
        - $ref: '#/components/schemas/Synthetics_commonMonitorFields'
        - required:
            - host
            - type
          type: object
          properties:
            host:
              type: string
              description: The host to ping.
            type:
              enum:
                - icmp
              type: string
              description: The monitor type.
            wait:
              type: number
              description: The wait time in seconds.
              default: 1
    Synthetics_monitorWarning:
      title: Monitor warning
      type: object
      properties:
        message:
          type: string
          description: A human-readable warning message.
        monitorId:
          type: string
          description: The monitor ID associated with the warning.
        publicLocationIds:
          type: array
          items:
            type: string
          description: The public location IDs associated with the warning.
    Synthetics_parameterRequest:
      title: Parameter request
      required:
        - key
        - value
      type: object
      properties:
        description:
          type: string
          description: A description of the parameter.
        key:
          type: string
          description: The key of the parameter.
        share_across_spaces:
          type: boolean
          description: Specify whether the parameter should be shared across spaces.
        tags:
          type: array
          items:
            type: string
          description: An array of tags to categorize the parameter.
        value:
          type: string
          description: The value associated with the parameter.
    Synthetics_postParameterResponse:
      title: Post parameter response
      type: object
      properties:
        description:
          type: string
          description: A description of the parameter.
        id:
          type: string
          description: The unique identifier for the parameter.
        key:
          type: string
          description: The parameter key.
        share_across_spaces:
          type: boolean
          description: Indicates whether the parameter is shared across spaces.
        tags:
          type: array
          items:
            type: string
          description: An array of tags associated with the parameter.
        value:
          type: string
          description: The value associated with the parameter.
    Synthetics_tcpMonitorFields:
      title: TCP monitor fields
      allOf:
        - $ref: '#/components/schemas/Synthetics_commonMonitorFields'
        - required:
            - host
            - type
          type: object
          properties:
            host:
              type: string
              description: "The host to monitor; it can be an IP address or a hostname. The host can include the port using a colon, for example \"example.com:9200\".\n"
            proxy_url:
              type: string
              description: "The URL of the SOCKS5 proxy to use when connecting to the server. The value must be a URL with a scheme of `socks5://`. If the SOCKS5 proxy server requires client authentication, then a username and password can be embedded in the URL. When using a proxy, hostnames are resolved on the proxy server instead of on the client. You can change this behavior by setting the `proxy_use_local_resolver` option.\n"
            proxy_use_local_resolver:
              type: boolean
              description: "Specify that hostnames are resolved locally instead of being resolved on the proxy server. If `false`, name resolution occurs on the proxy server.\n"
              default: false
            ssl:
              type: object
              description: "The TLS/SSL connection settings for use with the HTTPS endpoint. If you don't specify settings, the system defaults are used.\n"
            type:
              enum:
                - tcp
              type: string
              description: The monitor type.
    Task_manager_health_APIs_configuration:
      type: object
      description: "This object summarizes the current configuration of Task Manager. This includes dynamic configurations that change over time, such as `poll_interval` and `max_workers`, which can adjust in reaction to changing load on the system.\n"
    Task_manager_health_APIs_health_response:
      title: Task health response properties
      type: object
      properties:
        id:
          type: string
        last_update:
          type: string
        stats:
          type: object
          properties:
            capacity_estimation:
              type: object
              description: "This object provides a rough estimate about the sufficiency of its capacity. These are estimates based on historical data and should not be used as predictions.\n"
            configuration:
              $ref: '#/components/schemas/Task_manager_health_APIs_configuration'
            runtime:
              type: object
              description: "This object tracks runtime performance of Task Manager, tracking task drift, worker load, and stats broken down by type, including duration and run results.\n"
            workload:
              $ref: '#/components/schemas/Task_manager_health_APIs_workload'
        status:
          type: string
        timestamp:
          type: string
    Task_manager_health_APIs_workload:
      type: object
      description: "This object summarizes the work load across the cluster, including the tasks in the system, their types, and current status.\n"
    bedrock_config:
      title: Connector request properties for an Amazon Bedrock connector
      required:
        - apiUrl
      type: object
      properties:
        apiUrl:
          type: string
          description: The Amazon Bedrock request URL.
        region:
          type: string
          description: "Optional AWS region for request signing. Required when using a custom endpoint URL that does not include the region in the hostname (for example, `us-west-1`).\n"
        defaultModel:
          type: string
          description: "The generative artificial intelligence model for Amazon Bedrock to use. Current support is for the Anthropic Claude models.\n"
          default: us.anthropic.claude-sonnet-4-5-20250929-v1:0
      description: Defines properties for connectors when type is `.bedrock`.
    crowdstrike_config:
      title: Connector request config properties for a Crowdstrike connector
      required:
        - url
      type: object
      properties:
        url:
          type: string
          description: "The CrowdStrike tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
      description: Defines config properties for connectors when type is `.crowdstrike`.
    d3security_config:
      title: Connector request properties for a D3 Security connector
      required:
        - url
      type: object
      properties:
        url:
          type: string
          description: "The D3 Security API request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
      description: Defines properties for connectors when type is `.d3security`.
    email_config:
      title: Connector request properties for an email connector
      required:
        - from
      type: object
      properties:
        allowHtml:
          type: boolean
          description: "When `true`, the connector can send emails with HTML-formatted content in the body. Defaults to `false`. This option is unavailable when `service` is `elastic_cloud`.\n"
          default: false
        clientId:
          type:
            - 'null'
            - string
          description: "The client identifier, which is a part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n"
        from:
          type: string
          description: "The from address for all emails sent by the connector. It must be specified in `user@host-name` format.\n"
        hasAuth:
          type: boolean
          description: "Specifies whether a user and password are required inside the secrets configuration.\n"
          default: true
        host:
          type: string
          description: "The host name of the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n"
        oauthTokenUrl:
          type:
            - 'null'
            - string
        port:
          type: integer
          description: "The port to connect to on the service provider. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored. If `service` is `other`, this property must be defined.\n"
        secure:
          type: boolean
          description: "Specifies whether the connection to the service provider will use TLS. If the `service` is `elastic_cloud` (for Elastic Cloud notifications) or one of Nodemailer's well-known email service providers, this property is ignored.\n"
        service:
          enum:
            - elastic_cloud
            - exchange_server
            - gmail
            - other
            - outlook365
            - ses
          type: string
          description: "The name of the email service.\n"
        tenantId:
          type:
            - 'null'
            - string
          description: "The tenant identifier, which is part of OAuth 2.0 client credentials authentication, in GUID format. If `service` is `exchange_server`, this property is required.\n"
      description: Defines properties for connectors when type is `.email`.
    gemini_config:
      title: Connector request properties for an Google Gemini connector
      required:
        - apiUrl
        - gcpRegion
        - gcpProjectID
      type: object
      properties:
        apiUrl:
          type: string
          description: The Google Gemini request URL.
        defaultModel:
          type: string
          description: The generative artificial intelligence model for Google Gemini to use.
          default: gemini-2.5-pro
        gcpRegion:
          type: string
          description: The GCP region where the Vertex AI endpoint enabled.
        gcpProjectID:
          type: string
          description: The Google ProjectID that has Vertex AI endpoint enabled.
      description: Defines properties for connectors when type is `.gemini`.
    resilient_config:
      title: Connector request properties for a IBM Resilient connector
      required:
        - apiUrl
        - orgId
      type: object
      properties:
        apiUrl:
          type: string
          description: The IBM Resilient instance URL.
        orgId:
          type: string
          description: The IBM Resilient organization ID.
      description: Defines properties for connectors when type is `.resilient`.
    index_config:
      title: Connector request properties for an index connector
      required:
        - index
      type: object
      properties:
        executionTimeField:
          type:
            - 'null'
            - string
          description: A field that indicates when the document was indexed.
          default: 'null'
        index:
          type: string
          description: The Elasticsearch index to be written to.
        refresh:
          type: boolean
          description: "The refresh policy for the write request, which affects when changes are made visible to search. Refer to the refresh setting for Elasticsearch document APIs.\n"
          default: false
      description: Defines properties for connectors when type is `.index`.
    jira_config:
      title: Connector request properties for a Jira connector
      required:
        - apiUrl
        - projectKey
      type: object
      properties:
        apiUrl:
          type: string
          description: The Jira instance URL.
        projectKey:
          type: string
          description: The Jira project key.
      description: Defines properties for connectors when type is `.jira`.
    defender_config:
      title: Connector request properties for a Microsoft Defender for Endpoint connector
      required:
        - apiUrl
        - projectKey
      type: object
      properties:
        apiUrl:
          type: string
          description: "The URL of the Microsoft Defender for Endpoint API. If you are using the `xpack.actions.allowedHosts` setting, make sure the hostname is added to the allowed hosts.\n"
        clientId:
          type: string
          description: The application (client) identifier for your app in the Azure portal.
        oAuthScope:
          type: string
          description: The OAuth scopes or permission sets for the Microsoft Defender for Endpoint API.
        oAuthServerUrl:
          type: string
          description: The OAuth server URL where authentication is sent and received for the Microsoft Defender for Endpoint API.
        tenantId:
          type: string
          description: The tenant identifier for your app in the Azure portal.
      description: Defines properties for connectors when type is `.microsoft_defender_endpoint`.
    genai_azure_config:
      title: Connector request properties for an OpenAI connector that uses Azure OpenAI
      required:
        - apiProvider
        - apiUrl
      type: object
      properties:
        apiProvider:
          enum:
            - Azure OpenAI
          type: string
          description: The OpenAI API provider.
        apiUrl:
          type: string
          description: The OpenAI API endpoint.
      description: "Defines properties for connectors when type is `.gen-ai` and the API provider is `Azure OpenAI`.\n"
    genai_openai_config:
      title: Connector request properties for an OpenAI connector
      required:
        - apiProvider
        - apiUrl
      type: object
      properties:
        apiProvider:
          enum:
            - OpenAI
          type: string
          description: The OpenAI API provider.
        apiUrl:
          type: string
          description: The OpenAI API endpoint.
        defaultModel:
          type: string
          description: The default model to use for requests.
      description: "Defines properties for connectors when type is `.gen-ai` and the API provider is `OpenAI`.\n"
    opsgenie_config:
      title: Connector request properties for an Opsgenie connector
      required:
        - apiUrl
      type: object
      properties:
        apiUrl:
          type: string
          description: "The Opsgenie URL. For example, `https://api.opsgenie.com` or `https://api.eu.opsgenie.com`. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
      description: Defines properties for connectors when type is `.opsgenie`.
    pagerduty_config:
      title: Connector request properties for a PagerDuty connector
      type: object
      properties:
        apiUrl:
          type:
            - 'null'
            - string
          description: The PagerDuty event URL.
          example: https://events.pagerduty.com/v2/enqueue
      description: Defines properties for connectors when type is `.pagerduty`.
    sentinelone_config:
      title: Connector request properties for a SentinelOne connector
      required:
        - url
      type: object
      properties:
        url:
          type: string
          description: "The SentinelOne tenant URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
      description: Defines properties for connectors when type is `.sentinelone`.
    servicenow_config:
      title: Connector request properties for a ServiceNow ITSM connector
      required:
        - apiUrl
      type: object
      properties:
        apiUrl:
          type: string
          description: The ServiceNow instance URL.
        clientId:
          type: string
          description: "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n"
        isOAuth:
          type: boolean
          description: "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n"
          default: false
        jwtKeyId:
          type: string
          description: "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n"
        userIdentifierValue:
          type: string
          description: "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n"
        usesTableApi:
          type: boolean
          description: "Determines whether the connector uses the Table API or the Import Set API. This property is supported only for ServiceNow ITSM and ServiceNow SecOps connectors.  NOTE: If this property is set to `false`, the Elastic application should be installed in ServiceNow.\n"
          default: true
      description: Defines properties for connectors when type is `.servicenow`.
    servicenow_itom_config:
      title: Connector request properties for a ServiceNow ITOM connector
      required:
        - apiUrl
      type: object
      properties:
        apiUrl:
          type: string
          description: The ServiceNow instance URL.
        clientId:
          type: string
          description: "The client ID assigned to your OAuth application. This property is required when `isOAuth` is `true`.\n"
        isOAuth:
          type: boolean
          description: "The type of authentication to use. The default value is false, which means basic authentication is used instead of open authorization (OAuth).\n"
          default: false
        jwtKeyId:
          type: string
          description: "The key identifier assigned to the JWT verifier map of your OAuth application. This property is required when `isOAuth` is `true`.\n"
        userIdentifierValue:
          type: string
          description: "The identifier to use for OAuth authentication. This identifier should be the user field you selected when you created an OAuth JWT API endpoint for external clients in your ServiceNow instance. For example, if the selected user field is `Email`, the user identifier should be the user's email address. This property is required when `isOAuth` is `true`.\n"
      description: Defines properties for connectors when type is `.servicenow-itom`.
    slack_api_config:
      title: Connector request properties for a Slack connector
      type: object
      properties:
        allowedChannels:
          type: array
          items:
            maxItems: 25
            required:
              - id
              - name
            type: object
            properties:
              id:
                minLength: 1
                type: string
                description: The Slack channel ID.
                example: C123ABC456
              name:
                minLength: 1
                type: string
                description: The Slack channel name.
          description: A list of valid Slack channels.
      description: Defines properties for connectors when type is `.slack_api`.
    swimlane_config:
      title: Connector request properties for a Swimlane connector
      required:
        - apiUrl
        - appId
        - connectorType
      type: object
      properties:
        apiUrl:
          type: string
          description: The Swimlane instance URL.
        appId:
          type: string
          description: The Swimlane application ID.
        connectorType:
          enum:
            - all
            - alerts
            - cases
          type: string
          description: 'The type of connector. Valid values are `all`, `alerts`, and `cases`.'
        mappings:
          title: Connector mappings properties for a Swimlane connector
          type: object
          properties:
            alertIdConfig:
              title: Alert identifier mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the alert ID.
            caseIdConfig:
              title: Case identifier mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the case ID.
            caseNameConfig:
              title: Case name mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the case name.
            commentsConfig:
              title: Case comment mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the case comments.
            descriptionConfig:
              title: Case description mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the case description.
            ruleNameConfig:
              title: Rule name mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the name of the alert's rule.
            severityConfig:
              title: Severity mapping
              required:
                - fieldType
                - id
                - key
                - name
              type: object
              properties:
                fieldType:
                  type: string
                  description: The type of field in Swimlane.
                id:
                  type: string
                  description: The identifier for the field in Swimlane.
                key:
                  type: string
                  description: The key for the field in Swimlane.
                name:
                  type: string
                  description: The name of the field in Swimlane.
              description: Mapping for the severity.
          description: The field mapping.
      description: Defines properties for connectors when type is `.swimlane`.
    thehive_config:
      title: Connector request properties for a TheHive connector
      required:
        - url
      type: object
      properties:
        organisation:
          type: string
          description: "The organisation in TheHive that will contain the alerts or cases. By default, the connector uses the default organisation of the user account that created the API key.\n"
        url:
          type: string
          description: "The instance URL in TheHive. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
      description: Defines configuration properties for connectors when type is `.thehive`.
    tines_config:
      title: Connector request properties for a Tines connector
      required:
        - url
      type: object
      properties:
        url:
          type: string
          description: "The Tines tenant URL. If you are using the `xpack.actions.allowedHosts` setting, make sure this hostname is added to the allowed hosts.\n"
      description: Defines properties for connectors when type is `.tines`.
    torq_config:
      title: Connector request properties for a Torq connector
      required:
        - webhookIntegrationUrl
      type: object
      properties:
        webhookIntegrationUrl:
          type: string
          description: The endpoint URL of the Elastic Security integration in Torq.
      description: Defines properties for connectors when type is `.torq`.
    auth_type:
      title: Authentication type
      enum:
        - webhook-authentication-basic
        - webhook-authentication-ssl
        - webhook-oauth2-client-credentials
      type:
        - 'null'
        - string
      description: "The type of authentication to use: basic, SSL, OAuth2 client credentials, or none.\n"
    ca:
      title: Certificate authority
      type: string
      description: "A base64 encoded version of the certificate authority file that the connector can trust to sign and validate certificates. This option is available for all authentication types.\n"
    cert_type:
      title: Certificate type
      enum:
        - ssl-crt-key
        - ssl-pfx
      type: string
      description: "If the `authType` is `webhook-authentication-ssl`, specifies whether the certificate authentication data is in a CRT and key file format or a PFX file format.\n"
    has_auth:
      title: Has authentication
      type: boolean
      description: 'If true, a username and password for login type authentication must be provided.'
      default: true
    verification_mode:
      title: Verification mode
      enum:
        - certificate
        - full
        - none
      type: string
      description: "Controls the verification of certificates. Use `full` to validate that the certificate has an issue date within the `not_before` and `not_after` dates, chains to a trusted certificate authority (CA), and has a hostname or IP address that matches the names within the certificate. Use `certificate` to validate the certificate and verify that it is signed by a trusted authority; this option does not check the certificate hostname. Use `none` to skip certificate validation.\n"
      default: full
    webhook_config:
      title: Connector request properties for a Webhook connector
      type: object
      properties:
        accessTokenUrl:
          type: string
          description: "The URL used to request an OAuth2 access token. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required.\n"
        additionalFields:
          type:
            - 'null'
            - string
          description: "Additional fields, encoded as a JSON object, sent as part of the OAuth2 access token request body.\n"
        authType:
          $ref: '#/components/schemas/auth_type'
        ca:
          $ref: '#/components/schemas/ca'
        certType:
          $ref: '#/components/schemas/cert_type'
        clientId:
          type: string
          description: "The client identifier for OAuth2 authentication. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required.\n"
        hasAuth:
          $ref: '#/components/schemas/has_auth'
        headers:
          type:
            - 'null'
            - object
          description: A set of key-value pairs sent as headers with the request.
        method:
          enum:
            - post
            - put
            - patch
            - get
            - delete
          type: string
          description: "The HTTP request method: `post`, `put`, `patch`, `get`, or `delete`.\n"
          default: post
        scope:
          type: string
          description: "The scope requested when acquiring the OAuth2 access token.\n"
        url:
          type: string
          description: "The request URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
        verificationMode:
          $ref: '#/components/schemas/verification_mode'
      description: Defines properties for connectors when type is `.webhook`.
    cases_webhook_config:
      title: Connector request properties for Webhook - Case Management connector
      required:
        - createIncidentJson
        - createIncidentResponseKey
        - createIncidentUrl
        - getIncidentResponseExternalTitleKey
        - getIncidentUrl
        - updateIncidentJson
        - updateIncidentUrl
        - viewIncidentUrl
      type: object
      properties:
        authType:
          $ref: '#/components/schemas/auth_type'
        ca:
          $ref: '#/components/schemas/ca'
        certType:
          $ref: '#/components/schemas/cert_type'
        createCommentJson:
          type: string
          description: "A JSON payload sent to the create comment URL to create a case comment. You can use variables to add Kibana Cases data to the payload. The required variable is `case.comment`. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated once the Mustache variables have been placed when the REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n"
          example: '{"body": {{{case.comment}}}}'
        createCommentMethod:
          enum:
            - patch
            - post
            - put
          type: string
          description: "The REST API HTTP request method to create a case comment in the third-party system. Valid values are `patch`, `post`, and `put`.\n"
          default: put
        createCommentUrl:
          type: string
          description: "The REST API URL to create a case comment by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts setting`, add the hostname to the allowed hosts.\n"
          example: 'https://example.com/issue/{{{external.system.id}}}/comment'
        createIncidentJson:
          type: string
          description: "A JSON payload sent to the create case URL to create a case. You can use variables to add case data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n"
          example: '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
        createIncidentMethod:
          enum:
            - patch
            - post
            - put
          type: string
          description: "The REST API HTTP request method to create a case in the third-party system. Valid values are `patch`, `post`, and `put`.\n"
          default: post
        createIncidentResponseKey:
          type: string
          description: The JSON key in the create external case response that contains the case ID.
        createIncidentUrl:
          type: string
          description: "The REST API URL to create a case in the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
        getIncidentResponseExternalTitleKey:
          type: string
          description: The JSON key in get external case response that contains the case title.
        getIncidentUrl:
          type: string
          description: "The REST API URL to get the case by ID from the third-party system. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts. You can use a variable to add the external system ID to the URL. Due to Mustache template variables (the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid, disregarding the Mustache variables, so the later validation will pass.\n"
          example: 'https://example.com/issue/{{{external.system.id}}}'
        hasAuth:
          $ref: '#/components/schemas/has_auth'
        headers:
          type:
            - 'null'
            - object
          additionalProperties:
            type: string
          description: "A set of key-value pairs sent as headers with the request URLs for the create case, update case, get case, and create comment methods.\n"
        updateIncidentJson:
          type: string
          description: "The JSON payload sent to the update case URL to update the case. You can use variables to add Kibana Cases data to the payload. Required variables are `case.title` and `case.description`. Due to Mustache template variables (which is the text enclosed in triple braces, for example, `{{{case.title}}}`), the JSON is not validated when you create the connector. The JSON is validated after the Mustache variables have been placed when REST method runs. Manually ensure that the JSON is valid to avoid future validation errors; disregard Mustache variables during your review.\n"
          example: '{"fields": {"summary": {{{case.title}}},"description": {{{case.description}}},"labels": {{{case.tags}}}}}'
        updateIncidentMethod:
          enum:
            - patch
            - post
            - put
          type: string
          description: "The REST API HTTP request method to update the case in the third-party system. Valid values are `patch`, `post`, and `put`.\n"
          default: put
        updateIncidentUrl:
          type: string
          description: "The REST API URL to update the case by ID in the third-party system. You can use a variable to add the external system ID to the URL. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
          example: 'https://example.com/issue/{{{external.system.ID}}}'
        verificationMode:
          $ref: '#/components/schemas/verification_mode'
        viewIncidentUrl:
          type: string
          description: "The URL to view the case in the external system. You can use variables to add the external system ID or external system title to the URL.\n"
          example: 'https://testing-jira.atlassian.net/browse/{{{external.system.title}}}'
      description: Defines properties for connectors when type is `.cases-webhook`.
    xmatters_config:
      title: Connector request properties for an xMatters connector
      type: object
      properties:
        configUrl:
          type:
            - 'null'
            - string
          description: "The request URL for the Elastic Alerts trigger in xMatters. It is applicable only when `usesBasic` is `true`.\n"
        usesBasic:
          type: boolean
          description: Specifies whether the connector uses HTTP basic authentication (`true`) or URL authentication (`false`).
          default: true
      description: Defines properties for connectors when type is `.xmatters`.
    bedrock_secrets:
      title: Connector secrets properties for an Amazon Bedrock connector
      required:
        - accessKey
        - secret
      type: object
      properties:
        accessKey:
          type: string
          description: The AWS access key for authentication.
        secret:
          type: string
          description: The AWS secret for authentication.
      description: Defines secrets for connectors when type is `.bedrock`.
    crowdstrike_secrets:
      title: Connector secrets properties for a Crowdstrike connector
      required:
        - clientId
        - clientSecret
      type: object
      properties:
        clientId:
          type: string
          description: The CrowdStrike API client identifier.
        clientSecret:
          type: string
          description: The CrowdStrike API client secret to authenticate the `clientId`.
      description: Defines secrets for connectors when type is `.crowdstrike`.
    d3security_secrets:
      title: Connector secrets properties for a D3 Security connector
      required:
        - token
      type: object
      properties:
        token:
          type: string
          description: The D3 Security token.
      description: Defines secrets for connectors when type is `.d3security`.
    email_secrets:
      title: Connector secrets properties for an email connector
      type: object
      properties:
        clientSecret:
          type: string
          description: "The Microsoft Exchange Client secret for OAuth 2.0 client credentials authentication. It must be URL-encoded. If `service` is `exchange_server`, this property is required.\n"
        password:
          type: string
          description: "The password for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
        user:
          type: string
          description: "The username for HTTP basic authentication. If `hasAuth` is set to `true`, this property is required.\n"
      description: Defines secrets for connectors when type is `.email`.
    gemini_secrets:
      title: Connector secrets properties for a Google Gemini connector
      required:
        - credentialsJson
      type: object
      properties:
        credentialsJson:
          type: string
          description: The service account credentials JSON file. The service account should have Vertex AI user IAM role assigned to it.
      description: Defines secrets for connectors when type is `.gemini`.
    resilient_secrets:
      title: Connector secrets properties for IBM Resilient connector
      required:
        - apiKeyId
        - apiKeySecret
      type: object
      properties:
        apiKeyId:
          type: string
          description: The authentication key ID for HTTP Basic authentication.
        apiKeySecret:
          type: string
          description: The authentication key secret for HTTP Basic authentication.
      description: Defines secrets for connectors when type is `.resilient`.
    jira_secrets:
      title: Connector secrets properties for a Jira connector
      required:
        - apiToken
        - email
      type: object
      properties:
        apiToken:
          type: string
          description: The Jira API authentication token for HTTP basic authentication.
        email:
          type: string
          description: The account email for HTTP Basic authentication.
      description: Defines secrets for connectors when type is `.jira`.
    teams_secrets:
      title: Connector secrets properties for a Microsoft Teams connector
      required:
        - webhookUrl
      type: object
      properties:
        webhookUrl:
          type: string
          description: "The URL of the incoming webhook. If you are using the `xpack.actions.allowedHosts` setting, add the hostname to the allowed hosts.\n"
      description: Defines secrets for connectors when type is `.teams`.
    genai_secrets:
      title: Connector secrets properties for an OpenAI connector
      type: object
      properties:
        apiKey:
          type: string
          description: "The API key for authentication. For OpenAI and Azure OpenAI providers, it is required. For the `Other` provider, it is required if you do not use PKI authentication. With PKI, you can also optionally include an API key if the OpenAI-compatible service supports or requires one.\n"
        certificateData:
          minLength: 1
          type: string
          description: "Base64-encoded PEM certificate content for PKI authentication (Other provider only). Required for PKI.\n"
        privateKeyData:
          minLength: 1
          type: string
          description: "Base64-encoded PEM private key content for PKI authentication (Other provider only). Required for PKI.\n"
        caData:
          minLength: 1
          type: string
          description: "Base64-encoded PEM CA certificate content for PKI authentication (Other provider only). Optional.\n"
      description: "Defines secrets for connectors when type is `.gen-ai`. Supports both API key authentication (OpenAI, Azure OpenAI, and `Other`) and PKI authentication (`Other` provider only). PKI fields must be base64-encoded PEM content.\n"
    opsgenie_secrets:
      title: Connector secrets properties for an Opsgenie connector
      required:
        - apiKey
      type: object
      properties:
        apiKey:
          type: string
          description: The Opsgenie API authentication key for HTTP Basic authentication.
      description: Defines secrets for connectors when type is `.opsgenie`.
    pagerduty_secrets:
      title: Connector secrets properties for a PagerDuty connector
      required:
        - routingKey
      type: object
      properties:
        routingKey:
          type: string
          description: "A 32 character PagerDuty Integration Key for an integration on a service.\n"
      description: Defines secrets for connectors when type is `.pagerduty`.
    sentinelone_secrets:
      title: Connector secrets properties for a SentinelOne connector
      required:
        - token
      type: object
      properties:
        token:
          type: string
          description: The A SentinelOne API token.
      description: Defines secrets for connectors when type is `.sentinelone`.
    servicenow_secrets:
      title: 'Connector secrets properties for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors'
      type: object
      properties:
        clientSecret:
          type: string
          description: The client secret assigned to your OAuth application. This property is required when `isOAuth` is `true`.
        password:
          type: string
          description: The password for HTTP basic authentication. This property is required when `isOAuth` is `false`.
        privateKey:
          type: string
          description: The RSA private key that you created for use in ServiceNow. This property is required when `isOAuth` is `true`.
        privateKeyPassword:
          type: string
          description: The password for the RSA private key. This property is required when `isOAuth` is `true` and you set a password on your private key.
        username:
          type: string
          description: The username for HTTP basic authentication. This property is required when `isOAuth` is `false`.
      description: 'Defines secrets for connectors when type is `.servicenow`, `.servicenow-sir`, or `.servicenow-itom`.'
    slack_api_secrets:
      title: Connector secrets properties for a Web API Slack connector
      required:
        - token
      type: object
      properties:
        token:
          type: string
          description: Slack bot user OAuth token.
      description: Defines secrets for connectors when type is `.slack`.
    swimlane_secrets:
      title: Connector secrets properties for a Swimlane connector
      type: object
      properties:
        apiToken:
          type: string
          description: Swimlane API authentication token.
      description: Defines secrets for connectors when type is `.swimlane`.
    thehive_secrets:
      title: Connector secrets properties for a TheHive connector
      required:
        - apiKey
      type: object
      properties:
        apiKey:
          type: string
          description: The API key for authentication in TheHive.
      description: Defines secrets for connectors when type is `.thehive`.
    tines_secrets:
      title: Connector secrets properties for a Tines connector
      required:
        - email
        - token
      type: object
      properties:
        email:
          type: string
          description: The email used to sign in to Tines.
        token:
          type: string
          description: The Tines API token.
      description: Defines secrets for connectors when type is `.tines`.
    torq_secrets:
      title: Connector secrets properties for a Torq connector
      required:
        - token
      type: object
      properties:
        token:
          type: string
          description: The secret of the webhook authentication header.
      description: Defines secrets for connectors when type is `.torq`.
    crt:
      title: Certificate
      type: string
      description: 'If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the CRT or CERT file.'
    key:
      title: Certificate key
      type: string
      description: 'If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-crt-key`, it is a base64 encoded version of the KEY file.'
    pfx:
      title: Personal information exchange
      type: string
      description: 'If `authType` is `webhook-authentication-ssl` and `certType` is `ssl-pfx`, it is a base64 encoded version of the PFX or P12 file.'
    webhook_secrets:
      title: Connector secrets properties for a Webhook connector
      type: object
      properties:
        clientSecret:
          type: string
          description: "The client secret for OAuth2 authentication. If `hasAuth` is set to `true` and `authType` is `webhook-oauth2-client-credentials`, this property is required.\n"
        crt:
          $ref: '#/components/schemas/crt'
        key:
          $ref: '#/components/schemas/key'
        pfx:
          $ref: '#/components/schemas/pfx'
        password:
          type: string
          description: "The password for HTTP basic authentication or the passphrase for the SSL certificate files. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
        user:
          type: string
          description: "The username for HTTP basic authentication. If `hasAuth` is set to `true`  and `authType` is `webhook-authentication-basic`, this property is required.\n"
      description: Defines secrets for connectors when type is `.webhook`.
    cases_webhook_secrets:
      title: Connector secrets properties for Webhook - Case Management connector
      type: object
      properties:
        crt:
          $ref: '#/components/schemas/crt'
        key:
          $ref: '#/components/schemas/key'
        pfx:
          $ref: '#/components/schemas/pfx'
        password:
          type: string
          description: "The password for HTTP basic authentication. If `hasAuth` is set to `true` and and `authType` is `webhook-authentication-basic`, this property is required.\n"
        user:
          type: string
          description: "The username for HTTP basic authentication. If `hasAuth` is set to `true` and `authType` is `webhook-authentication-basic`, this property is required.\n"
    xmatters_secrets:
      title: Connector secrets properties for an xMatters connector
      type: object
      properties:
        password:
          type: string
          description: "A user name for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n"
        secretsUrl:
          type: string
          description: "The request URL for the Elastic Alerts trigger in xMatters with the API key included in the URL. It is applicable only when `usesBasic` is `false`.\n"
        user:
          type: string
          description: "A password for HTTP basic authentication. It is applicable only when `usesBasic` is `true`.\n"
      description: Defines secrets for connectors when type is `.xmatters`.
    genai_openai_other_config:
      title: Connector request properties for an OpenAI connector with Other provider
      required:
        - apiProvider
        - apiUrl
        - defaultModel
      type: object
      properties:
        apiProvider:
          enum:
            - Other
          type: string
          description: The OpenAI API provider.
        apiUrl:
          type: string
          description: The OpenAI-compatible API endpoint.
        defaultModel:
          type: string
          description: The default model to use for requests.
        certificateData:
          minLength: 1
          type: string
          description: PEM-encoded certificate content.
        privateKeyData:
          minLength: 1
          type: string
          description: PEM-encoded private key content.
        caData:
          minLength: 1
          type: string
          description: PEM-encoded CA certificate content.
        verificationMode:
          enum:
            - full
            - certificate
            - none
          type: string
          description: SSL verification mode for PKI authentication.
          default: full
        headers:
          type: object
          additionalProperties:
            type: string
          description: Custom headers to include in requests.
      description: "Defines properties for connectors when type is `.gen-ai` and the API provider is `Other` (OpenAI-compatible service), including optional PKI authentication.\n"
    defender_secrets:
      title: Connector secrets properties for a Microsoft Defender for Endpoint connector
      required:
        - clientSecret
      type: object
      properties:
        clientSecret:
          type: string
          description: The client secret for your app in the Azure portal.
      description: Defines secrets for connectors when type is `..microsoft_defender_endpoint`.
    run_acknowledge_resolve_pagerduty:
      title: PagerDuty connector parameters
      required:
        - dedupKey
        - eventAction
      type: object
      properties:
        dedupKey:
          maxLength: 255
          type: string
          description: The deduplication key for the PagerDuty alert.
        eventAction:
          enum:
            - acknowledge
            - resolve
          type: string
          description: The type of event.
      description: Test an action that acknowledges or resolves a PagerDuty alert.
    run_documents:
      title: Index connector parameters
      required:
        - documents
      type: object
      properties:
        documents:
          type: array
          items:
            type: object
          description: The documents in JSON format for index connectors.
      description: Test an action that indexes a document into Elasticsearch.
    run_message_email:
      title: Email connector parameters
      required:
        - message
        - subject
      type: object
      properties:
        bcc:
          type: array
          items:
            type: string
          description: "A list of \"blind carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format\n"
        cc:
          type: array
          items:
            type: string
          description: "A list of \"carbon copy\" email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format \n"
        message:
          type: string
          description: The email message text. Markdown format is supported.
        subject:
          type: string
          description: The subject line of the email.
        to:
          type: array
          items:
            type: string
          description: "A list of email addresses. Addresses can be specified in `user@host-name` format or in name `<user@host-name>` format.\n"
      description: "Test an action that sends an email message. There must be at least one recipient in `to`, `cc`, or `bcc`.\n"
    run_message_serverlog:
      title: Server log connector parameters
      required:
        - message
      type: object
      properties:
        level:
          enum:
            - debug
            - error
            - fatal
            - info
            - trace
            - warn
          type: string
          description: The log level of the message for server log connectors.
          default: info
        message:
          type: string
          description: The message for server log connectors.
      description: Test an action that writes an entry to the Kibana server log.
    run_message_slack:
      title: Slack connector parameters
      required:
        - message
      type: object
      properties:
        message:
          type: string
          description: 'The Slack message text, which cannot contain Markdown, images, or other advanced formatting.'
      description: "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack`.\n"
    run_trigger_pagerduty:
      title: PagerDuty connector parameters
      required:
        - eventAction
      type: object
      properties:
        class:
          type: string
          description: The class or type of the event.
          example: cpu load
        component:
          type: string
          description: The component of the source machine that is responsible for the event.
          example: eth0
        customDetails:
          type: object
          description: Additional details to add to the event.
        dedupKey:
          maxLength: 255
          type: string
          description: "All actions sharing this key will be associated with the same PagerDuty alert. This value is used to correlate trigger and resolution.\n"
        eventAction:
          enum:
            - trigger
          type: string
          description: The type of event.
        group:
          type: string
          description: The logical grouping of components of a service.
          example: app-stack
        links:
          type: array
          items:
            type: object
            properties:
              href:
                type: string
                description: The URL for the link.
              text:
                type: string
                description: A plain text description of the purpose of the link.
          description: A list of links to add to the event.
        severity:
          enum:
            - critical
            - error
            - info
            - warning
          type: string
          description: The severity of the event on the affected system.
          default: info
        source:
          type: string
          description: "The affected system, such as a hostname or fully qualified domain name. Defaults to the Kibana saved object id of the action.\n"
        summary:
          maxLength: 1024
          type: string
          description: A summery of the event.
        timestamp:
          type: string
          description: An ISO-8601 timestamp that indicates when the event was detected or generated.
          format: date-time
      description: Test an action that triggers a PagerDuty alert.
    run_addevent:
      title: The addEvent subaction
      required:
        - subAction
      type: object
      properties:
        subAction:
          enum:
            - addEvent
          type: string
          description: The action to test.
        subActionParams:
          type: object
          properties:
            additional_info:
              type: string
              description: Additional information about the event.
            description:
              type: string
              description: The details about the event.
            event_class:
              type: string
              description: A specific instance of the source.
            message_key:
              type: string
              description: All actions sharing this key are associated with the same ServiceNow alert. The default value is `<rule ID>:<alert instance ID>`.
            metric_name:
              type: string
              description: The name of the metric.
            node:
              type: string
              description: The host that the event was triggered for.
            resource:
              type: string
              description: The name of the resource.
            severity:
              type: string
              description: The severity of the event.
            source:
              type: string
              description: The name of the event source type.
            time_of_event:
              type: string
              description: The time of the event.
            type:
              type: string
              description: The type of event.
          description: The set of configuration properties for the action.
      description: The `addEvent` subaction for ServiceNow ITOM connectors.
    run_closealert:
      title: The closeAlert subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - closeAlert
          type: string
          description: The action to test.
        subActionParams:
          required:
            - alias
          type: object
          properties:
            alias:
              type: string
              description: The unique identifier used for alert deduplication in Opsgenie. The alias must match the value used when creating the alert.
            note:
              type: string
              description: Additional information for the alert.
            source:
              type: string
              description: The display name for the source of the alert.
            user:
              type: string
              description: The display name for the owner.
      description: The `closeAlert` subaction for Opsgenie connectors.
    run_closeincident:
      title: The closeIncident subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - closeIncident
          type: string
          description: The action to test.
        subActionParams:
          required:
            - incident
          type: object
          properties:
            incident:
              type: object
              anyOf:
                - required:
                    - correlation_id
                - required:
                    - externalId
              properties:
                correlation_id:
                  maxLength: 100
                  type:
                    - 'null'
                    - string
                  description: "An identifier that is assigned to the incident when it is created by the connector. NOTE: If you use the default value and the rule generates multiple alerts that use the same alert IDs, the latest open incident for this correlation ID is closed unless you specify the external ID.\n"
                  default: '{{rule.id}}:{{alert.id}}'
                externalId:
                  type:
                    - 'null'
                    - string
                  description: The unique identifier (`incidentId`) for the incident in ServiceNow.
      description: The `closeIncident` subaction for ServiceNow ITSM connectors.
    run_createalert:
      title: The createAlert subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - createAlert
          type: string
          description: The action to test.
        subActionParams:
          type: object
          properties:
            actions:
              type: array
              items:
                type: string
              description: The custom actions available to the alert in Opsgenie connectors.
            alias:
              type: string
              description: The unique identifier used for alert deduplication in Opsgenie.
            description:
              type: string
              description: A description that provides detailed information about the alert.
            details:
              type: object
              description: The custom properties of the alert in Opsgenie connectors.
              example:
                key1: value1
                key2: value2
            entity:
              type: string
              description: 'The domain of the alert in Opsgenie connectors. For example, the application or server name.'
            message:
              type: string
              description: The alert message in Opsgenie connectors.
            note:
              type: string
              description: Additional information for the alert in Opsgenie connectors.
            priority:
              enum:
                - P1
                - P2
                - P3
                - P4
                - P5
              type: string
              description: The priority level for the alert in Opsgenie connectors.
            responders:
              type: array
              items:
                type: object
                properties:
                  id:
                    type: string
                    description: The identifier for the entity.
                  name:
                    type: string
                    description: The name of the entity.
                  type:
                    enum:
                      - escalation
                      - schedule
                      - team
                      - user
                    type: string
                    description: 'The type of responders, in this case `escalation`.'
                  username:
                    type: string
                    description: A valid email address for the user.
              description: "The entities to receive notifications about the alert in Opsgenie connectors. If `type` is `user`, either `id` or `username` is required. If `type` is `team`, either `id` or `name` is required.\n"
            severity:
              maximum: 4
              minimum: 1
              type: integer
              description: "The severity of the incident for TheHive connectors. The value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n"
            source:
              type: string
              description: The display name for the source of the alert in Opsgenie and TheHive connectors.
            sourceRef:
              type: string
              description: A source reference for the alert in TheHive connectors.
            tags:
              type: array
              items:
                type: string
              description: The tags for the alert in Opsgenie and TheHive connectors.
            title:
              type: string
              description: "A title for the incident for TheHive connectors. It is used for searching the contents of the knowledge base.\n"
            tlp:
              maximum: 4
              minimum: 0
              type: integer
              description: "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n"
              default: 2
            type:
              type: string
              description: The type of alert in TheHive connectors.
            user:
              type: string
              description: The display name for the owner.
            visibleTo:
              type: array
              items:
                required:
                  - type
                type: object
                properties:
                  id:
                    type: string
                    description: The identifier for the entity.
                  name:
                    type: string
                    description: The name of the entity.
                  type:
                    enum:
                      - team
                      - user
                    type: string
                    description: Valid values are `team` and `user`.
                  username:
                    type: string
                    description: The user name. This property is required only when the `type` is `user`.
              description: 'The teams and users that the alert will be visible to without sending a notification. Only one of `id`, `name`, or `username` is required.'
      description: The `createAlert` subaction for Opsgenie and TheHive connectors.
    run_fieldsbyissuetype:
      title: The fieldsByIssueType subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - fieldsByIssueType
          type: string
          description: The action to test.
        subActionParams:
          required:
            - id
          type: object
          properties:
            id:
              type: string
              description: The Jira issue type identifier.
              example: 10024
      description: The `fieldsByIssueType` subaction for Jira connectors.
    run_getagentdetails:
      title: The getAgentDetails subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - getAgentDetails
          type: string
          description: The action to test.
        subActionParams:
          required:
            - ids
          type: object
          properties:
            ids:
              type: array
              items:
                type: string
              description: An array of CrowdStrike agent identifiers.
          description: The set of configuration properties for the action.
      description: The `getAgentDetails` subaction for CrowdStrike connectors.
    run_getagents:
      title: The getAgents subaction
      required:
        - subAction
      type: object
      properties:
        subAction:
          enum:
            - getAgents
          type: string
          description: The action to test.
      description: The `getAgents` subaction for SentinelOne connectors.
    run_getchoices:
      title: The getChoices subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - getChoices
          type: string
          description: The action to test.
        subActionParams:
          required:
            - fields
          type: object
          properties:
            fields:
              type: array
              items:
                type: string
              description: An array of fields.
          description: The set of configuration properties for the action.
      description: 'The `getChoices` subaction for ServiceNow ITOM, ServiceNow ITSM, and ServiceNow SecOps connectors.'
    run_getfields:
      title: The getFields subaction
      required:
        - subAction
      type: object
      properties:
        subAction:
          enum:
            - getFields
          type: string
          description: The action to test.
      description: 'The `getFields` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.'
    run_getincident:
      title: The getIncident subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - getIncident
          type: string
          description: The action to test.
        subActionParams:
          required:
            - externalId
          type: object
          properties:
            externalId:
              type: string
              description: 'The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier.'
              example: 71778
      description: 'The `getIncident` subaction for Jira, ServiceNow ITSM, and ServiceNow SecOps connectors.'
    run_issue:
      title: The issue subaction
      required:
        - subAction
      type: object
      properties:
        subAction:
          enum:
            - issue
          type: string
          description: The action to test.
        subActionParams:
          required:
            - id
          type: object
          properties:
            id:
              type: string
              description: The Jira issue identifier.
              example: 71778
      description: The `issue` subaction for Jira connectors.
    run_issues:
      title: The issues subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - issues
          type: string
          description: The action to test.
        subActionParams:
          required:
            - title
          type: object
          properties:
            title:
              type: string
              description: The title of the Jira issue.
      description: The `issues` subaction for Jira connectors.
    run_issuetypes:
      title: The issueTypes subaction
      required:
        - subAction
      type: object
      properties:
        subAction:
          enum:
            - issueTypes
          type: string
          description: The action to test.
      description: The `issueTypes` subaction for Jira connectors.
    run_postmessage:
      title: The postMessage subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - postMessage
          type: string
          description: The action to test.
        subActionParams:
          type: object
          properties:
            channelIds:
              maxItems: 1
              type: array
              items:
                type: string
              description: "The Slack channel identifier, which must be one of the `allowedChannels` in the connector configuration.\n"
            channels:
              maxItems: 1
              type: array
              items:
                type: string
              description: "The name of a channel that your Slack app has access to.\n"
              deprecated: true
            text:
              minLength: 1
              type: string
              description: "The Slack message text. If it is a Slack webhook connector, the text cannot contain Markdown, images, or other advanced formatting. If it is a Slack web API connector, it can contain either plain text or block kit messages.\n"
          description: The set of configuration properties for the action.
      description: "Test an action that sends a message to Slack. It is applicable only when the connector type is `.slack_api`.\n"
    run_pushtoservice:
      title: The pushToService subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - pushToService
          type: string
          description: The action to test.
        subActionParams:
          type: object
          properties:
            comments:
              type: array
              items:
                type: object
                properties:
                  comment:
                    type: string
                    description: 'A comment related to the incident. For example, describe how to troubleshoot the issue.'
                  commentId:
                    type: integer
                    description: A unique identifier for the comment.
              description: 'Additional information that is sent to Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, or TheHive.'
            incident:
              type: object
              properties:
                additional_fields:
                  maxLength: 20
                  type:
                    - 'null'
                    - string
                  description: "Additional fields for ServiceNow ITSM and ServiveNow SecOps connectors. The fields must exist in the Elastic ServiceNow application and must be specified in JSON format.\n"
                alertId:
                  type: string
                  description: The alert identifier for Swimlane connectors.
                caseId:
                  type: string
                  description: The case identifier for the incident for Swimlane connectors.
                caseName:
                  type: string
                  description: The case name for the incident for Swimlane connectors.
                category:
                  type: string
                  description: The category of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                correlation_display:
                  type: string
                  description: A descriptive label of the alert for correlation purposes for ServiceNow ITSM and ServiceNow SecOps connectors.
                correlation_id:
                  type: string
                  description: "The correlation identifier for the security incident for ServiceNow ITSM and ServiveNow SecOps connectors. Connectors using the same correlation ID are associated with the same ServiceNow incident. This value determines whether a new ServiceNow incident is created or an existing one is updated. Modifying this value is optional; if not modified, the rule ID and alert ID are combined as `{{ruleID}}:{{alert ID}}` to form the correlation ID value in ServiceNow. The maximum character length for this value is 100 characters. NOTE: Using the default configuration of `{{ruleID}}:{{alert ID}}` ensures that ServiceNow creates a separate incident record for every generated alert that uses a unique alert ID. If the rule generates multiple alerts that use the same alert IDs, ServiceNow creates and continually updates a single incident record for the alert.\n"
                description:
                  type: string
                  description: 'The description of the incident for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.'
                dest_ip:
                  oneOf:
                    - type: string
                    - type: array
                      items:
                        type: string
                  description: "A list of destination IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.\n"
                externalId:
                  type: string
                  description: "The Jira, ServiceNow ITSM, or ServiceNow SecOps issue identifier. If present, the incident is updated. Otherwise, a new incident is created.\n"
                id:
                  type: string
                  description: The external case identifier for Webhook - Case Management connectors.
                impact:
                  type: string
                  description: The impact of the incident for ServiceNow ITSM connectors.
                issueType:
                  type: integer
                  description: 'The type of incident for Jira connectors. For example, 10006. To obtain the list of valid values, set `subAction` to `issueTypes`.'
                labels:
                  type: array
                  items:
                    type: string
                  description: "The labels for the incident for Jira connectors. NOTE: Labels cannot contain spaces.\n"
                malware_hash:
                  oneOf:
                    - type: string
                    - type: array
                      items:
                        type: string
                  description: A list of malware hashes related to the security incident for ServiceNow SecOps connectors. The hashes are added as observables to the security incident.
                malware_url:
                  type: string
                  oneOf:
                    - type: string
                    - type: array
                      items:
                        type: string
                  description: A list of malware URLs related to the security incident for ServiceNow SecOps connectors. The URLs are added as observables to the security incident.
                otherFields:
                  maxProperties: 20
                  type: object
                  description: "Custom field identifiers and their values for Jira connectors.\n"
                parent:
                  type: string
                  description: The ID or key of the parent issue for Jira connectors. Applies only to `Sub-task` types of issues.
                priority:
                  type: string
                  description: The priority of the incident in Jira and ServiceNow SecOps connectors.
                ruleName:
                  type: string
                  description: The rule name for Swimlane connectors.
                severity:
                  type: integer
                  description: "The severity of the incident for ServiceNow ITSM, Swimlane, and TheHive connectors. In TheHive connectors, the severity value ranges from 1 (low) to 4 (critical) with a default value of 2 (medium).\n"
                short_description:
                  type: string
                  description: "A short description of the incident for ServiceNow ITSM and ServiceNow SecOps connectors. It is used for searching the contents of the knowledge base.\n"
                source_ip:
                  oneOf:
                    - type: string
                    - type: array
                      items:
                        type: string
                  description: A list of source IP addresses related to the security incident for ServiceNow SecOps connectors. The IPs are added as observables to the security incident.
                status:
                  type: string
                  description: The status of the incident for Webhook - Case Management connectors.
                subcategory:
                  type: string
                  description: The subcategory of the incident for ServiceNow ITSM and ServiceNow SecOps connectors.
                summary:
                  type: string
                  description: A summary of the incident for Jira connectors.
                tags:
                  type: array
                  items:
                    type: string
                  description: A list of tags for TheHive and Webhook - Case Management connectors.
                title:
                  type: string
                  description: "A title for the incident for Jira, TheHive, and Webhook - Case Management connectors. It is used for searching the contents of the knowledge base.\n"
                tlp:
                  maximum: 4
                  minimum: 0
                  type: integer
                  description: "The traffic light protocol designation for the incident in TheHive connectors. Valid values include: 0 (clear), 1 (green), 2 (amber), 3 (amber and strict), and 4 (red).\n"
                  default: 2
                urgency:
                  type: string
                  description: The urgency of the incident for ServiceNow ITSM connectors.
              description: 'Information necessary to create or update a Jira, ServiceNow ITSM, ServiveNow SecOps, Swimlane, or TheHive incident.'
          description: The set of configuration properties for the action.
      description: 'The `pushToService` subaction for Jira, ServiceNow ITSM, ServiceNow SecOps, Swimlane, TheHive, and Webhook - Case Management connectors.'
    run_validchannelid:
      title: The validChannelId subaction
      required:
        - subAction
        - subActionParams
      type: object
      properties:
        subAction:
          enum:
            - validChannelId
          type: string
          description: The action to test.
        subActionParams:
          required:
            - channelId
          type: object
          properties:
            channelId:
              type: string
              description: The Slack channel identifier.
              example: C123ABC456
      description: "Retrieves information about a valid Slack channel identifier. It is applicable only when the connector type is `.slack_api`.\n"
  parameters:
    APM_UI_elastic_api_version:
      name: elastic-api-version
      in: header
      description: The version of the API to use
      required: true
      schema:
        enum:
          - '2023-10-31'
        type: string
        default: '2023-10-31'
    APM_UI_kbn_xsrf:
      name: kbn-xsrf
      in: header
      description: A required header to protect against CSRF attacks
      required: true
      schema:
        type: string
        example: 'true'
    Cases_alert_id:
      name: alertId
      in: path
      description: An identifier for the alert.
      required: true
      schema:
        type: string
        example: 09f0c261e39e36351d75995b78bb83673774d1bc2cca9df2d15f0e5c0a99a540
    Cases_assignees_filter:
      name: assignees
      in: query
      description: "Filters the returned cases by assignees. Valid values are `none` or unique identifiers for the user profiles. These identifiers can be found by using the suggest user profile API.\n"
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_string'
          - $ref: '#/components/schemas/Cases_string_array'
    Cases_case_id:
      name: caseId
      in: path
      description: 'The identifier for the case. To retrieve case IDs, use the search cases (`_find)` API. All non-ASCII characters must be URL encoded.'
      required: true
      schema:
        type: string
        example: 9c235210-6834-11ea-a78c-6ffb38a34414
    Cases_category:
      name: category
      in: query
      description: Filters the returned cases by category.
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_case_category'
          - $ref: '#/components/schemas/Cases_case_categories'
    Cases_comment_id:
      name: commentId
      in: path
      description: "The identifier for the comment. To retrieve comment IDs, use the get case or search cases (`_find`) APIs.\n"
      required: true
      schema:
        type: string
        example: 71ec1870-725b-11ea-a0b2-c51ea50a58e2
    Cases_configuration_id:
      name: configurationId
      in: path
      description: An identifier for the configuration.
      required: true
      schema:
        type: string
        example: 3297a0f0-b5ec-11ec-b141-0fdb20a7f9a9
    Cases_connector_id:
      name: connectorId
      in: path
      description: 'An identifier for the connector. To retrieve connector IDs, use the find connectors API.'
      required: true
      schema:
        type: string
        example: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
    Cases_defaultSearchOperator:
      name: defaultSearchOperator
      in: query
      description: he default operator to use for the simple_query_string.
      schema:
        type: string
        default: OR
      example: OR
    Cases_from:
      name: from
      in: query
      description: "Returns only cases that were created after a specific date. The date must be specified as a KQL data range or date match expression.\n"
      schema:
        type: string
        example: now-1d
    Cases_ids:
      name: ids
      in: query
      description: "The cases that you want to removed. To get the case identifiers, use the search cases (`_find`) API. In the Dev Console, you can specify the array of cases in the following format: `ids=[\"e58e77e3-ef8e-4251-926f-efb115f3c4ec\"]`. In `curl`, all non-ASCII characters must be URL encoded. For example: `ids=%5B%22e58e77e3-ef8e-4251-926f-efb115f3c4ec%22%5D`\n"
      required: true
      schema:
        type: array
        items:
          maxItems: 100
          minItems: 1
          type: string
          example: d4e7abb0-b462-11ec-9a8d-698504725a43
    Cases_kbn_xsrf:
      name: kbn-xsrf
      in: header
      description: Cross-site request forgery protection
      required: true
      schema:
        type: string
    Cases_owner_filter:
      name: owner
      in: query
      description: "A filter to limit the response to a specific set of applications. If this parameter is omitted, the response contains information about all the cases that the user has access to read.\n"
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_owner'
          - $ref: '#/components/schemas/Cases_owners'
      example: cases
    Cases_page_index:
      name: page
      in: query
      description: The page number to return.
      schema:
        type: integer
        default: 1
      example: 1
    Cases_page_size:
      name: perPage
      in: query
      description: The number of items to return. Limited to 100 items.
      schema:
        maximum: 100
        type: integer
        default: 20
      example: 20
    Cases_reporters:
      name: reporters
      in: query
      description: Filters the returned cases by the user name of the reporter.
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_string'
          - $ref: '#/components/schemas/Cases_string_array'
      example: elastic
    Cases_search:
      name: search
      in: query
      description: An Elasticsearch simple_query_string query that filters the objects in the response.
      schema:
        type: string
      example: Case title 1
    Cases_searchFields:
      name: searchFields
      in: query
      description: The fields to perform the simple_query_string parsed query against.
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_searchFieldsType'
          - $ref: '#/components/schemas/Cases_searchFieldsTypeArray'
    Cases_severity:
      name: severity
      in: query
      description: The severity of the case.
      schema:
        enum:
          - critical
          - high
          - low
          - medium
        type: string
      example: low
    Cases_sort_order:
      name: sortOrder
      in: query
      description: Determines the sort order.
      schema:
        enum:
          - asc
          - desc
        type: string
        default: desc
      example: desc
    Cases_sortField:
      name: sortField
      in: query
      description: Determines which field is used to sort the results.
      schema:
        enum:
          - createdAt
          - updatedAt
          - closedAt
          - title
          - category
          - status
          - severity
        type: string
        default: createdAt
      example: updatedAt
    Cases_status:
      name: status
      in: query
      description: Filters the returned cases by state.
      schema:
        enum:
          - closed
          - in-progress
          - open
        type: string
      example: open
    Cases_tags:
      name: tags
      in: query
      description: Filters the returned cases by tags.
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_string'
          - $ref: '#/components/schemas/Cases_string_array'
      example: tag-1
    Cases_template_author:
      name: author
      in: query
      description: Filters the returned templates by author username.
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_string'
          - $ref: '#/components/schemas/Cases_string_array'
      example: elastic
    Cases_template_id:
      name: template_id
      in: path
      description: The identifier for the template.
      required: true
      schema:
        maxLength: 36
        type: string
      example: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
    Cases_template_is_enabled:
      name: isEnabled
      in: query
      description: Filters the returned templates by their enabled state.
      schema:
        type: boolean
      example: true
    Cases_template_sort_field:
      name: sortField
      in: query
      description: Determines which field is used to sort the results.
      schema:
        enum:
          - templateId
          - name
          - templateVersion
          - owner
          - deletedAt
          - author
          - usageCount
          - fieldCount
          - lastUsedAt
          - isDefault
          - isLatest
        type: string
        default: name
      example: name
    Cases_template_tags:
      name: tags
      in: query
      description: Filters the returned templates by tags.
      schema:
        oneOf:
          - $ref: '#/components/schemas/Cases_string'
          - $ref: '#/components/schemas/Cases_string_array'
      example: tag-1
    Cases_template_version:
      name: version
      in: query
      description: 'The version number of the template to retrieve. If omitted, the latest version is returned.'
      schema:
        minimum: 1
        type: integer
      example: 1
    Cases_to:
      name: to
      in: query
      description: "Returns only cases that were created before a specific date. The date must be specified as a KQL data range or date match expression.\n"
      schema:
        type: string
      example: now+1d
    Cases_user_action_types:
      name: types
      in: query
      description: Determines the types of user actions to return.
      schema:
        type: array
        items:
          enum:
            - action
            - alert
            - assignees
            - attachment
            - comment
            - connector
            - create_case
            - description
            - pushed
            - settings
            - severity
            - status
            - tags
            - title
            - user
          type: string
          example: create_case
    Data_views_field_name:
      name: fieldName
      in: path
      description: The name of the runtime field.
      required: true
      schema:
        type: string
        example: hour_of_day
    Data_views_kbn_xsrf:
      name: kbn-xsrf
      in: header
      description: Cross-site request forgery protection
      required: true
      schema:
        type: string
    Data_views_view_id:
      name: viewId
      in: path
      description: An identifier for the data view.
      required: true
      schema:
        type: string
        example: ff959d40-b880-11e8-a6d9-e546fe2bba5f
    Machine_learning_APIs_simulateParam:
      name: simulate
      in: query
      description: 'When true, simulates the synchronization by returning only the list of actions that would be performed.'
      schema:
        type: boolean
      example: 'true'
    Short_URL_APIs_idParam:
      name: id
      in: path
      description: The identifier for the short URL.
      required: true
      schema:
        type: string
    SLOs_kbn_xsrf:
      name: kbn-xsrf
      in: header
      description: Cross-site request forgery protection
      required: true
      schema:
        type: string
    SLOs_slo_id:
      name: sloId
      in: path
      description: An identifier for the slo.
      required: true
      schema:
        type: string
        example: 9c235211-6834-11ea-a78c-6feb38a34414
    SLOs_space_id:
      name: spaceId
      in: path
      description: 'An identifier for the space. If `/s/` and the identifier are omitted from the path, the default space is used.'
      required: true
      schema:
        type: string
        example: default
  examples:
    Alerting_401_health_response:
      summary: Unauthorized response for the get alerting health API.
      value:
        error: Unauthorized
        message: '[security_exception] missing authentication credentials for REST request'
        statusCode: 401
    Alerting_401_rule_types_response:
      summary: Unauthorized response for the get rule types API.
      value:
        error: Unauthorized
        message: '[security_exception] missing authentication credentials for REST request'
        statusCode: 401
    Alerting_get_health_response:
      summary: Retrieve information about the health of the alerting framework.
      value:
        alerting_framework_health:
          decryption_health:
            status: ok
            timestamp: '2023-01-13T01:28:00.280Z'
          execution_health:
            status: ok
            timestamp: '2023-01-13T01:28:00.280Z'
          read_health:
            status: ok
            timestamp: '2023-01-13T01:28:00.280Z'
        has_permanent_encryption_key: true
        is_sufficiently_secure: true
    Alerting_get_rule_types_response:
      summary: Retrieve rule types associated with Kibana machine learning features
      value:
        - action_groups:
            - id: anomaly_score_match
              name: Anomaly score matched the condition
            - id: recovered
              name: Recovered
          action_variables:
            context:
              - description: The bucket timestamp of the anomaly
                name: timestamp
              - description: The bucket time of the anomaly in ISO8601 format
                name: timestampIso8601
              - description: List of job IDs that triggered the alert
                name: jobIds
              - description: Alert info message
                name: message
              - description: Indicate if top hits contain interim results
                name: isInterim
              - description: Anomaly score at the time of the notification action
                name: score
              - description: Top records
                name: topRecords
              - description: Top influencers
                name: topInfluencers
              - description: URL to open in the Anomaly Explorer
                name: anomalyExplorerUrl
                useWithTripleBracesInTemplates: true
            params: [ ]
            state: [ ]
          alerts:
            context: ml.anomaly-detection
            mappings:
              fieldMap:
                kibana.alert.anomaly_score:
                  array: false
                  type: double
                  required: false
                kibana.alert.anomaly_timestamp:
                  array: false
                  type: date
                  required: false
                kibana.alert.is_interim:
                  array: false
                  type: boolean
                  required: false
                kibana.alert.job_id:
                  array: false
                  type: keyword
                  required: true
                kibana.alert.top_influencers:
                  array: true
                  dynamic: false
                  type: object
                  properties:
                    influencer_field_name:
                      type: keyword
                    influencer_field_value:
                      type: keyword
                    influencer_score:
                      type: double
                    initial_influencer_score:
                      type: double
                    is_interim:
                      type: boolean
                    job_id:
                      type: keyword
                    timestamp:
                      type: date
                  required: false
                kibana.alert.top_records:
                  array: true
                  dynamic: false
                  type: object
                  properties:
                    actual:
                      type: double
                    by_field_name:
                      type: keyword
                    by_field_value:
                      type: keyword
                    detector_index:
                      type: integer
                    field_name:
                      type: keyword
                    function:
                      type: keyword
                    initial_record_score:
                      type: double
                    is_interim:
                      type: boolean
                    job_id:
                      type: keyword
                    over_field_name:
                      type: keyword
                    over_field_value:
                      type: keyword
                    partition_field_name:
                      type: keyword
                    partition_field_value:
                      type: keyword
                    record_score:
                      type: double
                    timestamp:
                      type: date
                    typical:
                      type: double
                  required: false
            shouldWrite: true
          authorized_consumers:
            alerts:
              all: true
              read: true
            apm:
              all: true
              read: true
            discover:
              all: true
              read: true
            infrastructure:
              all: true
              read: true
            logs:
              all: true
              read: true
            ml:
              all: true
              read: true
            monitoring:
              all: true
              read: true
            siem:
              all: true
              read: true
            slo:
              all: true
              read: true
            stackAlerts:
              all: true
              read: true
            uptime:
              all: true
              read: true
          category: management
          default_action_group_id: anomaly_score_match
          does_set_recovery_context: true
          enabled_in_license: true
          has_alerts_mappings: true
          has_fields_for_a_a_d: true
          id: xpack.ml.anomaly_detection_alert
          is_exportable: true
          minimum_license_required: platinum
          name: Anomaly detection alert
          producer: ml
          recovery_action_group:
            id: recovered
            name: Recovered
          rule_task_timeout: 5m
        - action_groups:
            - id: anomaly_detection_realtime_issue
              name: Issue detected
            - id: recovered
              name: Recovered
          action_variables:
            context:
              - description: Results of the rule execution
                name: results
              - description: Alert info message
                name: message
            params: [ ]
            state: [ ]
          authorized_consumers:
            alerts:
              all: true
              read: true
            apm:
              all: true
              read: true
            discover:
              all: true
              read: true
            infrastructure:
              all: true
              read: true
            logs:
              all: true
              read: true
            ml:
              all: true
              read: true
            monitoring:
              all: true
              read: true
            siem:
              all: true
              read: true
            slo:
              all: true
              read: true
            stackAlerts:
              all: true
              read: true
            uptime:
              all: true
              read: true
          category: management
          default_action_group_id: anomaly_detection_realtime_issue
          does_set_recovery_context: true
          enabled_in_license: true
          has_alerts_mappings: false
          has_fields_for_a_a_d: false
          id: xpack.ml.anomaly_detection_jobs_health
          is_exportable: true
          minimum_license_required: platinum
          name: Anomaly detection jobs health
          producer: ml
          recovery_action_group:
            id: recovered
            name: Recovered
          rule_task_timeout: 5m
    APM_UI_agent_configuration_environments_200_response1:
      description: An example of a successful response from `GET /api/apm/settings/agent-configuration/environments`.
      value:
        environments:
          - alreadyConfigured: true
            name: production
          - alreadyConfigured: false
            name: development
          - alreadyConfigured: false
            name: ALL_OPTION_VALUE
    APM_UI_agent_configuration_intake_object_delete_200_response1:
      description: An example of a successful response from `DELETE /api/apm/settings/agent-configuration`.
      value:
        result: deleted
    APM_UI_agent_configuration_intake_object_delete_request1:
      description: Run `DELETE /api/apm/settings/agent-configuration` to delete a configuration.
      value:
        service:
          environment: production
          name: frontend
    APM_UI_agent_configuration_intake_object_get_200_response1:
      description: An example of a successful response from `GET /api/apm/settings/agent-configuration`.
      value:
        - '@timestamp': 1581934104843
          agent_name: go
          applied_by_agent: false
          etag: 1e58c178efeebae15c25c539da740d21dee422fc
          service:
            environment: production
            name: opbeans-go
          settings:
            capture_body: off
            transaction_max_spans: '200'
            transaction_sample_rate: '1'
        - '@timestamp': 1581934111727
          agent_name: go
          applied_by_agent: false
          etag: 3eed916d3db434d9fb7f039daa681c7a04539a64
          service:
            name: opbeans-go
          settings:
            capture_body: off
            transaction_max_spans: '300'
            transaction_sample_rate: '1'
        - '@timestamp': 1582031336265
          agent_name: nodejs
          applied_by_agent: false
          etag: 5080ed25785b7b19f32713681e79f46996801a5b
          service:
            name: frontend
          settings:
            transaction_sample_rate: '1'
    APM_UI_agent_configuration_intake_object_put_200_response1:
      description: An example of a successful response from `PUT /api/apm/settings/agent-configuration`. The response body is intentionally empty.
      value: { }
    APM_UI_agent_configuration_intake_object_put_request1:
      description: Run `PUT /api/apm/settings/agent-configuration` to create or update configuration details.
      value:
        agent_name: nodejs
        service:
          environment: production
          name: frontend
        settings:
          capture_body: off
          transaction_max_spans: '500'
          transaction_sample_rate: '0.4'
    APM_UI_agent_configuration_intake_object_search_200_response1:
      description: An example of a successful response from `POST /api/apm/settings/agent-configuration/search`.
      value:
        _id: CIaqXXABmQCdPphWj8EJ
        _index: .apm-agent-configuration
        _score: 2
        _source:
          '@timestamp': 1582031336265
          agent_name: nodejs
          applied_by_agent: false
          etag: 5080ed25785b7b19f32713681e79f46996801a5b
          service:
            name: frontend
          settings:
            transaction_sample_rate: '1'
    APM_UI_agent_configuration_intake_object_search_request1:
      description: Run `POST /api/apm/settings/agent-configuration/search` to search configuration details.
      value:
        etag: 1e58c178efeebae15c25c539da740d21dee422fc
        service:
          environment: production
          name: frontend
    APM_UI_agent_configuration_intake_object_view_200_response1:
      description: An example of a successful response from `GET /api/apm/settings/agent-configuration/view`.
      value:
        '@timestamp': 1582031336265
        agent_name: nodejs
        applied_by_agent: true
        etag: 5080ed25785b7b19f32713681e79f46996801a5b
        id: CIaqXXABmQCdPphWj8EJ
        service:
          environment: production
          name: frontend
        settings:
          capture_body: off
          transaction_max_spans: '500'
          transaction_sample_rate: '0.4'
    APM_UI_agent_keys_object_post_200_response1:
      description: 'An example of a successful response from `POST /api/apm/agent_keys`, which creates an APM agent API key.'
      value:
        agentKey:
          api_key: PjGloCGOTzaZr8ilUPvkjA
          encoded: M0RDTG1uMEIzWk1oTFVhN1dCRzk6UGpHbG9DR09UemFacjhpbFVQdmtqQQ==
          id: 3DCLmn0B3ZMhLUa7WBG9
          name: apm-key
    APM_UI_agent_keys_object_post_request1:
      description: Run `POST /api/apm/agent_keys` to create an APM agent API key with the specified privileges.
      value:
        name: apm-key
        privileges:
          - event:write
          - config_agent:read
    APM_UI_annotation_object_post_200_response1:
      description: 'An example of a successful response from `POST /api/apm/services/opbeans-java/annotation`, which creates an annotation for a service named `opbeans-java`.'
      value:
        _id: Lc9I93EBh6DbmkeV7nFX
        _index: observability-annotations
        _primary_term: 1
        _seq_no: 12
        _source:
          '@timestamp': '2020-05-08T10:31:30.452Z'
          annotation:
            type: deployment
          event:
            created: '2020-05-09T02:34:43.937Z'
          message: Deployment 1.2
          service:
            name: opbeans-java
            version: '1.2'
          tags:
            - apm
            - elastic.co
            - customer
        _version: 1
        found: true
    APM_UI_annotation_object_post_request1:
      description: 'Run `POST /api/apm/services/{serviceName}/annotation` to create a deployment annotation for a service.'
      value:
        '@timestamp': '2024-01-15T12:00:00.000Z'
        message: Deployment 1.2.0
        service:
          environment: production
          version: '1.2.0'
        tags:
          - apm
          - deployment
    APM_UI_annotation_search_get_200_response1:
      description: 'An example of a successful response from `GET /api/apm/services/{serviceName}/annotation/search`, which returns the annotations associated with a service over the given time range.'
      value:
        annotations:
          - '@timestamp': 1735689600000
            id: opbeans-node@2.0.0
            text: opbeans-node@2.0.0
            type: version
          - '@timestamp': 1736294400000
            id: opbeans-node@2.1.0
            text: opbeans-node@2.1.0
            type: version
    APM_UI_error_400_response:
      description: 'An example of a 400 Bad Request response, returned when the request payload or query parameters fail validation.'
      value:
        error: Bad Request
        message: '[request body]: expected value of type [string] but got [undefined]'
        statusCode: 400
    APM_UI_error_401_response:
      description: 'An example of a 401 Unauthorized response, returned when the request is missing valid authentication credentials.'
      value:
        error: Unauthorized
        message: '[security_exception]: missing authentication credentials for REST request'
        statusCode: 401
    APM_UI_error_403_response:
      description: 'An example of a 403 Forbidden response, returned when the authenticated user lacks the required APM and User Experience privileges.'
      value:
        error: Forbidden
        message: Insufficient privileges to perform this action. The APM and User Experience feature requires `all` privileges.
        statusCode: 403
    APM_UI_error_404_response:
      description: 'An example of a 404 Not Found response, returned when the requested resource does not exist or the feature is not available on the current deployment.'
      value:
        error: Not Found
        message: Not Found
        statusCode: 404
    APM_UI_error_500_response:
      description: 'An example of a 500 Internal Server Error response, returned when an unexpected error occurs while processing the request.'
      value:
        error: Internal Server Error
        message: An internal server error occurred. Check the Kibana server logs for details.
        statusCode: 500
    APM_UI_error_501_response:
      description: 'An example of a 501 Not Implemented response, returned when the source map feature is not available on the current deployment.'
      value:
        error: Not Implemented
        message: Not Implemented
        statusCode: 501
    APM_UI_fleet_apm_server_schema_200_response1:
      description: An example of a successful response from `POST /api/apm/fleet/apm_server_schema`. The response body is intentionally empty.
      value: { }
    APM_UI_service_agent_name_get_200_response1:
      description: 'An example of a successful response from `GET /api/apm/settings/agent-configuration/agent_name`, which returns the detected APM agent name for a service.'
      value:
        agentName: nodejs
    APM_UI_source_maps_delete_200_response1:
      description: 'An example of a successful response from `DELETE /api/apm/sourcemaps/{id}`. The response body is intentionally empty.'
      value: { }
    APM_UI_source_maps_get_200_response1:
      description: A successful response from `GET /api/apm/sourcemaps`.
      value:
        artifacts:
          - body:
              bundleFilepath: /test/e2e/general-usecase/bundle.js
              serviceName: foo
              serviceVersion: 1.0.0
              sourceMap:
                file: static/js/main.chunk.js
                mappings: mapping
                sourceRoot: ''
                sources:
                  - fleet-source-map-client/src/index.css
                  - fleet-source-map-client/src/App.js
                  - webpack:///./src/index.css?bb0a
                  - fleet-source-map-client/src/index.js
                  - fleet-source-map-client/src/reportWebVitals.js
                sourcesContent:
                  - content
                version: 3
            compressionAlgorithm: zlib
            created: '2021-07-09T20:47:44.812Z'
            decodedSha256: 644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456
            decodedSize: 441
            encodedSha256: 024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24
            encodedSize: 237
            encryptionAlgorithm: none
            id: apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456
            identifier: foo-1.0.0
            packageName: apm
            relative_url: /api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456
            type: sourcemap
    APM_UI_source_maps_upload_200_response1:
      description: A successful response from `POST /api/apm/sourcemaps`.
      value:
        body: eJyFkL1OwzAUhd/Fc+MbYMuCEBIbHRjKgBgc96R16tiWr1OQqr47NwqJxEK3q/PzWccXxchnZ7E1A1SjuhjVZtF2yOxiEPlO17oWox3D3uPFeSRTjmJQARfCPeiAgGx8NTKsYdAc1T3rwaSJGcds8Sp3c1HnhfywUZ3QhMTFFGepZxqMC9oex3CS9tpk1XyozgOlmoVKuJX1DqEQZ0su7PGtLU+V/3JPKc3cL7TJ2FNDRPov4bFta3MDM4f7W69lpJjLO9qdK8bzVPhcJz3HUCQ4LbO/p5hCSC4cZPByrp/wFqOklbpefwAhzpqI
        compressionAlgorithm: zlib
        created: '2021-07-09T20:47:44.812Z'
        decodedSha256: 644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456
        decodedSize: 441
        encodedSha256: 024c72749c3e3dd411b103f7040ae62633558608f480bce4b108cf5b2275bd24
        encodedSize: 237
        encryptionAlgorithm: none
        id: apm:foo-1.0.0-644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456
        identifier: foo-1.0.0
        packageName: apm
        relative_url: /api/fleet/artifacts/foo-1.0.0/644fd5a997d1ddd90ee131ba18e2b3d03931d89dd1fe4599143c0b3264b3e456
        type: sourcemap
    APM_UI_source_maps_upload_request1:
      description: "An example of a multipart/form-data request body for `POST /api/apm/sourcemaps`.\nEach field is a separate form part; `sourcemap` is the source map file content (typically uploaded as a file).\n"
      value:
        bundle_filepath: /test/e2e/general-usecase/bundle.js.map
        service_name: opbeans-node
        service_version: 1.0.0
        sourcemap: '{"version":3,"sources":["bundle.js"],"names":[],"mappings":"AAAA","file":"bundle.js","sourcesContent":["console.log(''hello'');"]}'
    Cases_add_comment_request:
      summary: Adds a comment to a case.
      value:
        comment: A new comment.
        owner: cases
        type: user
    Cases_add_comment_response:
      summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
      value:
        assignees: [ ]
        category: 'null'
        closed_at: 'null'
        closed_by: 'null'
        comments:
          - comment: A new comment.
            created_at: '2022-10-02T00:49:47.716Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
            owner: cases
            pushed_at: 'null'
            pushed_by: 'null'
            type: user
            updated_at: 'null'
            updated_by: 'null'
            version: WzIwNDMxLDFd
        connector:
          fields: 'null'
          id: none
          name: none
          type: .none
        created_at: '2022-03-24T00:37:03.906Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: Field value
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: true
        description: A case description.
        duration: 'null'
        external_service: 'null'
        id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
        observables: [ ]
        owner: cases
        settings:
          syncAlerts: false
        severity: low
        status: open
        tags:
          - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 1
        totalEvents: 0
        updated_at: '2022-06-03T00:49:47.716Z'
        updated_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzIzMzgsMV0=
    Cases_create_case_request:
      summary: Create a security case that uses a Jira connector.
      value:
        connector:
          fields:
            issueType: '10006'
            parent: 'null'
            priority: High
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My field value
        description: A case description.
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        tags:
          - tag-1
        title: Case title 1
    Cases_create_case_response:
      summary: The create case API returns a JSON object that contains details about the case.
      value:
        assignees: [ ]
        closed_at: 'null'
        closed_by: 'null'
        comments: [ ]
        connector:
          fields:
            issueType: '10006'
            parent: 'null'
            priority: High
          id: 131d4448-abe0-4789-939d-8ef60680b498
          name: My connector
          type: .jira
        created_at: '2022-10-13T15:33:50.604Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My field value
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: 'null'
        description: A case description.
        duration: 'null'
        external_service: 'null'
        id: 66b9aa00-94fa-11ea-9f74-e7e108796192
        observables: [ ]
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
          - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: 'null'
        updated_by: 'null'
        version: WzUzMiwxXQ==
    Cases_find_case_activity_response:
      summary: Retrieves all activity for a case
      value:
        page: 1
        perPage: 20
        total: 3
        userActions:
          - action: create
            comment_id: 'null'
            created_at: '2023-10-20T01:17:22.150Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            id: b4cd0770-07c9-11ed-a5fd-47154cb8767e
            owner: cases
            payload:
              assignees: [ ]
              category: 'null'
              connector:
                fields: 'null'
                id: none
                name: none
                type: .none
              customFields:
                - key: d312efda-ec2b-42ec-9e2c-84981795c581
                  type: text
                  value: My field value
                - key: fcc6840d-eb14-42df-8aaf-232201a705ec
                  type: toggle
                  value: 'null'
              description: A case description.
              owner: cases
              settings:
                syncAlerts: false
              severity: low
              status: open
              tags:
                - tag 1
              title: Case title 1
            type: create_case
            version: WzM1ODg4LDFd
          - action: create
            comment_id: 578608d0-03b1-11ed-920c-974bfa104448
            created_at: '2023-10-14T20:12:53.354Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            id: 57af14a0-03b1-11ed-920c-974bfa104448
            owner: cases
            payload:
              comment:
                comment: A new comment
                owner: cases
                type: user
            type: comment
            version: WzM1ODg4LDFa
          - action: add
            comment_id: 'null'
            created_at: '2023-10-20T01:10:28.238Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            id: 573c6980-6123-11ed-aa41-81a0a61fe447
            owner: cases
            payload:
              assignees:
                - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            type: assignees
            version: WzM1ODg4LDFb
    Cases_find_case_comments_response:
      summary: Paginated list of user comments for a case
      value:
        comments:
          - comment: A new comment
            created_at: '2023-10-07T19:32:13.104Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
            owner: cases
            pushed_at: 'null'
            pushed_by: 'null'
            type: user
            updated_at: 'null'
            updated_by: 'null'
            version: WzIzLDFd
        page: 1
        per_page: 20
        total: 1
    Cases_find_case_response:
      summary: 'Retrieve the first five cases with the `tag-1` tag, in ascending order by last update time.'
      value:
        cases:
          - assignees: [ ]
            category: 'null'
            closed_at: 'null'
            closed_by: 'null'
            comments: [ ]
            connector:
              fields: 'null'
              id: none
              name: none
              type: .none
            created_at: '2023-10-12T00:16:36.371Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            customFields:
              - key: d312efda-ec2b-42ec-9e2c-84981795c581
                type: text
                value: My field value
              - key: fcc6840d-eb14-42df-8aaf-232201a705ec
                type: toggle
                value: 'null'
            description: Case description
            duration: 'null'
            external_service: 'null'
            id: abed3a70-71bd-11ea-a0b2-c51ea50a58e2
            incremental_id: 1
            observables: [ ]
            owner: cases
            settings:
              extractObservables: false
              syncAlerts: true
            severity: low
            status: open
            tags:
              - tag-1
            title: Case title
            total_observables: 0
            totalAlerts: 0
            totalComment: 1
            totalEvents: 0
            updated_at: '2023-10-12T00:27:58.162Z'
            updated_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            version: WzExMCwxXQ==
        count_closed_cases: 0
        count_in_progress_cases: 0
        count_open_cases: 1
        page: 1
        per_page: 5
        total: 1
    Cases_find_connector_response:
      summary: Retrieve information about the connectors and their settings.
      value:
        - actionTypeId: .jira
          config:
            apiUrl: https://elastic.atlassian.net/
            projectKey: ES
          id: 61787f53-4eee-4741-8df6-8fe84fa616f7
          isDeprecated: false
          isMissingSecrets: false
          isPreconfigured: false
          name: my-Jira
          referencedByCount: 0
    Cases_get_case_alerts_response:
      summary: Retrieves all alerts attached to a case
      value:
        - attached_at: '2022-07-25T20:09:40.963Z'
          id: f6a7d0c3-d52d-432c-b2e6-447cd7fce04d
          index: .alerts-observability.logs.alerts-default
    Cases_get_case_applicable_fields_response:
      summary: Fields applicable to a case
      value:
        fields:
          - control: SELECT_BASIC
            defaultValue: medium
            displayOnly: false
            isGlobal: true
            key: priority_as_keyword
            label: Priority
            name: priority
            options:
              - low
              - medium
              - high
            type: keyword
            required: true
            requiredOnClose: false
            source: global
          - control: TEXTAREA
            displayOnly: false
            isGlobal: false
            key: rollout_notes_as_keyword
            label: Rollout notes
            name: rollout_notes
            type: keyword
            required: false
            requiredOnClose: true
            source: template
          - control: MARKDOWN
            displayOnly: true
            isGlobal: false
            key: instructions_as_keyword
            label: Instructions
            name: instructions
            type: keyword
            required: false
            requiredOnClose: false
            source: template
    Cases_get_case_configuration_response:
      summary: Get the case configuration.
      value:
        - closure_type: close-by-user
          connector:
            fields: 'null'
            id: none
            name: none
            type: .none
          created_at: '2024-07-01T17:07:17.767Z'
          created_by:
            email: 'null'
            full_name: 'null'
            username: elastic
          customFields:
            - defaultValue: Custom text field value.
              key: d312efda-ec2b-42ec-9e2c-84981795c581
              label: my-text-field
              type: text
              required: false
          error: 'null'
          id: 856ee650-6c82-11ee-a20a-6164169afa58
          mappings: [ ]
          observableTypes: [ ]
          owner: cases
          templates:
            - caseFields:
                assignees:
                  - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
                category: Default-category
                connector:
                  fields: 'null'
                  id: none
                  name: none
                  type: .none
                customFields:
                  - key: d312efda-ec2b-42ec-9e2c-84981795c581
                    type: text
                    value: Default text field value.
                description: A default description for cases.
                settings:
                  syncAlerts: false
                tags:
                  - Default case tag
                title: Default case title
              description: A description of the template.
              key: 505932fe-ee3a-4960-a661-c781b5acdb05
              name: template-1
              tags:
                - Template tag 1
          updated_at: 'null'
          updated_by: 'null'
          version: WzEyLDNd
    Cases_get_case_observability_response:
      summary: Get case response (Observability). Comments are not included; use the find case comments API. totalComment reflects the actual count.
      value:
        assignees:
          - uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
        category: 'null'
        closed_at: 'null'
        closed_by: 'null'
        connector:
          fields: 'null'
          id: none
          name: none
          type: .none
        created_at: '2023-11-06T19:29:04.086Z'
        created_by:
          email: 'null'
          full_name: 'null'
          username: elastic
        customFields: [ ]
        description: An Observability case description.
        duration: 'null'
        external_service: 'null'
        id: c3ff7550-def1-4e90-b6bc-c9969a4a09b1
        observables: [ ]
        owner: observability
        settings:
          extractObservables: false
          syncAlerts: false
        severity: low
        status: in-progress
        tags:
          - observability
          - tag 1
        title: Observability case title 1
        total_observables: 0
        totalAlerts: 1
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-11-06T19:47:55.662Z'
        updated_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzI0NywyXQ==
    Cases_get_case_response:
      summary: Get case response. Comments are not included; use the find case comments API. totalComment reflects the actual count.
      value:
        assignees:
          - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
        category: 'null'
        closed_at: 'null'
        closed_by: 'null'
        connector:
          fields: 'null'
          id: none
          name: none
          type: .none
        created_at: '2023-10-13T15:33:50.604Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My field value
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: 'null'
        description: A case description
        duration: 'null'
        external_service: 'null'
        id: 31cdada0-02c1-11ed-85f2-4f7c222ca2fa
        incremental_id: 1
        observables: [ ]
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
          - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 1
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-10-13T15:40:32.335Z'
        updated_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzM2LDFd
    Cases_get_case_template_response:
      summary: A case template.
      value:
        definition: { }
        definitionString: 'fields: []'
        deletedAt: 'null'
        isLatest: true
        latestVersion: 1
        name: My Template
        owner: cases
        templateId: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
        templateVersion: 1
    Cases_get_case_templates_response:
      summary: A paginated list of case templates.
      value:
        page: 1
        perPage: 20
        templates:
          - definition: { }
            definitionString: 'fields: []'
            deletedAt: 'null'
            fieldSearchMatches: false
            isLatest: true
            latestVersion: 1
            name: My Template
            owner: cases
            templateId: 9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42
            templateVersion: 1
        total: 1
    Cases_get_comment_response:
      summary: A single user comment retrieved from a case
      value:
        comment: A new comment
        created_at: '2023-10-07T19:32:13.104Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        id: 8048b460-fe2b-11ec-b15d-779a7c8bbcc3
        owner: cases
        pushed_at: 'null'
        pushed_by: 'null'
        type: user
        updated_at: 'null'
        updated_by: 'null'
        version: WzIzLDFd
    Cases_get_reporters_response:
      summary: A list of two users that opened cases
      value:
        - email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        - email: jdoe@example.com
          full_name: Jane Doe
          profile_uid: u_0wpfV1MqYDaXzLtRVY-gLMrddKDEmfz51Fszhj7hWC8_0
          username: jdoe
    Cases_get_tags_response:
      summary: A list of tags that are used in cases
      value:
        - observability
        - security
        - tag 1
        - tag 2
    Cases_push_case_response:
      summary: The push case API returns a JSON object with details about the case and the external service.
      value:
        assignees: [ ]
        category: 'null'
        closed_at: 'null'
        closed_by: 'null'
        comments: [ ]
        connector:
          fields:
            issueType: '10006'
            parent: 'null'
            priority: Low
          id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
          name: My connector
          type: .jira
        created_at: '2022-07-29T00:59:39.444Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields: [ ]
        description: A case description.
        duration: 'null'
        external_service:
          connector_id: 09f8c0b0-0eda-11ed-bd18-65557fe66949
          connector_name: My connector
          external_id: '71926'
          external_title: ES-554
          external_url: https://cases.jira.com
          pushed_at: '2022-07-29T01:20:58.436Z'
          pushed_by:
            email: 'null'
            full_name: 'null'
            username: elastic
        id: b917f300-0ed9-11ed-bd18-65557fe66949
        observables: [ ]
        owner: cases
        settings:
          extractObservables: false
          syncAlerts: true
        severity: low
        status: open
        tags:
          - tag 1
        title: Case title 1
        total_observables: 0
        totalAlerts: 0
        totalComment: 0
        totalEvents: 0
        updated_at: '2022-07-29T01:20:58.436Z'
        updated_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzE3NjgsM10=
    Cases_response_400_invalid_template:
      summary: The request is invalid.
      value:
        error: Bad Request
        message: 'Template [invalid-template-id] not found for owner [cases]'
        statusCode: 400
    Cases_response_400_template_limit:
      summary: A template resource limit was exceeded.
      value:
        error: Bad Request
        message: A template cannot define more than 200 fields.
        statusCode: 400
    Cases_response_401:
      summary: Authorization information is missing or invalid.
      value:
        error: Unauthorized
        message: Unable to authenticate with the provided credentials.
        statusCode: 401
    Cases_response_403:
      summary: The user does not have access to the requested resource.
      value:
        error: Forbidden
        message: Unauthorized to access cases
        statusCode: 403
    Cases_response_404:
      summary: The requested resource was not found.
      value:
        error: Not Found
        message: 'Saved object [cases-template/9da1ea2a-09f8-4d0e-bf9d-09bf8c9d0f42] not found'
        statusCode: 404
    Cases_response_409:
      summary: A resource conflict occurred.
      value:
        error: Conflict
        message: Template name "Security incident" already exists for owner "cases"
        statusCode: 409
    Cases_set_case_configuration_request:
      summary: 'Set the closure type, custom fields, and default connector for Stack Management cases.'
      value:
        closure_type: close-by-user
        connector:
          fields: 'null'
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        customFields:
          - defaultValue: My custom field default value.
            key: d312efda-ec2b-42ec-9e2c-84981795c581
            label: my-text-field
            type: text
            required: false
        owner: cases
        templates:
          - caseFields:
              assignees:
                - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              category: Default-category
              customFields:
                - key: d312efda-ec2b-42ec-9e2c-84981795c581
                  type: text
                  value: A text field value for the template.
              description: A default description for cases.
              tags:
                - Default case tag
              title: Default case title
            description: A description of the template.
            key: 505932fe-ee3a-4960-a661-c781b5acdb05
            name: template-1
            tags:
              - Template tag 1
    Cases_set_case_configuration_response:
      summary: This is an example response for case settings.
      value:
        closure_type: close-by-user
        connector:
          fields: 'null'
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: 'null,'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
          - defaultValue: My custom field default value.
            key: d312efda-ec2b-42ec-9e2c-84981795c581
            label: my-text-field
            type: text
            required: false
        error: 'null'
        id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
        mappings:
          - action_type: overwrite
            source: title
            target: summary
          - action_type: overwrite
            source: description
            target: description
          - action_type: append
            source: comments
            target: comments
          - action_type: overwrite
            source: tags
            target: labels
        owner: cases
        templates:
          - caseFields:
              assignees:
                - uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              category: Default-category
              customFields:
                - key: d312efda-ec2b-42ec-9e2c-84981795c581
                  type: text
                  value: A text field value for the template.
              description: A default description for cases.
              tags:
                - Default case tag
              title: Default case title
            description: A description of the template.
            key: 505932fe-ee3a-4960-a661-c781b5acdb05
            name: template-1
            tags:
              - Template tag 1
        updated_at: 'null'
        updated_by: 'null'
        version: WzIwNzMsMV0=
    Cases_template_dry_run_response:
      summary: Dry-run validation succeeded without writing.
      value:
        valid: true
    Cases_template_write_request:
      summary: Create or fully replace a case template.
      value:
        definition: "name: Security incident\nseverity: high\ntags: [security]\nfields:\n  - name: priority\n    label: Priority\n    type: keyword\n    control: SELECT_BASIC\n    metadata:\n      options: [low, medium, high]\n      default: medium\n"
        description: Default template for security incidents.
        isEnabled: true
        name: Security incident
        owner: cases
        tags:
          - security
    Cases_update_case_configuration_request:
      summary: Update the case settings.
      value:
        closure_type: close-by-user
        connector:
          fields: 'null'
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        customFields:
          - defaultValue: A new default value.
            key: d312efda-ec2b-42ec-9e2c-84981795c581
            label: my-text-field
            type: text
            required: true
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            label: my-toggle
            type: toggle
            required: false
        version: WzExOSw0XQ==
    Cases_update_case_configuration_response:
      summary: This is an example response when the case configuration was updated.
      value:
        closure_type: close-by-user
        connector:
          fields: 'null'
          id: 5e656730-e1ca-11ec-be9b-9b1838238ee6
          name: my-jira-connector
          type: .jira
        created_at: '2024-07-01T17:07:17.767Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
          - defaultValue: A new default value.
            key: d312efda-ec2b-42ec-9e2c-84981795c581
            label: my-text-field
            type: text
            required: true
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            label: my-toggle
            type: toggle
            required: false
        error: 'null'
        id: 4a97a440-e1cd-11ec-be9b-9b1838238ee6
        mappings:
          - action_type: overwrite
            source: title
            target: summary
          - action_type: overwrite
            source: description
            target: description
          - action_type: overwrite
            source: tags
            target: labels
          - action_type: append
            source: comments
            target: comments
        owner: cases
        templates: [ ]
        updated_at: '2024-07-19T00:52:42.401Z'
        updated_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzI2LDNd
    Cases_update_case_request:
      summary: 'Update the case description, tags, and connector.'
      value:
        cases:
          - connector:
              fields:
                issueType: '10006'
                parent: 'null'
                priority: 'null'
              id: 131d4448-abe0-4789-939d-8ef60680b498
              name: My connector
              type: .jira
            customFields:
              - key: fcc6840d-eb14-42df-8aaf-232201a705ec
                type: toggle
                value: false
              - key: d312efda-ec2b-42ec-9e2c-84981795c581
                type: text
                value: My new field value
            description: A case description.
            id: a18b38a0-71b0-11ea-a0b2-c51ea50a58e2
            settings:
              extractObservables: false
              syncAlerts: true
            tags:
              - tag-1
            version: WzIzLDFd
    Cases_update_case_response:
      summary: 'This is an example response when the case description, tags, and connector were updated.'
      value:
        - assignees: [ ]
          category: 'null'
          closed_at: 'null'
          closed_by: 'null'
          comments: [ ]
          connector:
            fields:
              issueType: '10006'
              parent: 'null'
              priority: 'null'
            id: 131d4448-abe0-4789-939d-8ef60680b498
            name: My connector
            type: .jira
          created_at: '2023-10-13T09:16:17.416Z'
          created_by:
            email: 'null'
            full_name: 'null'
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          customFields:
            - key: d312efda-ec2b-42ec-9e2c-84981795c581
              type: text
              value: My new field value
            - key: fcc6840d-eb14-42df-8aaf-232201a705ec
              type: toggle
              value: false
          description: A case description.
          duration: 'null'
          external_service:
            connector_id: 05da469f-1fde-4058-99a3-91e4807e2de8
            connector_name: Jira
            external_id: '10003'
            external_title: IS-4
            external_url: https://hms.atlassian.net/browse/IS-4
            pushed_at: '2023-10-13T09:20:40.672Z'
            pushed_by:
              email: 'null'
              full_name: 'null'
              username: elastic
          id: 66b9aa00-94fa-11ea-9f74-e7e108796192
          observables: [ ]
          owner: cases
          settings:
            extractObservables: false
            syncAlerts: true
          severity: low
          status: open
          tags:
            - tag-1
          title: Case title 1
          total_observables: 0
          totalAlerts: 0
          totalComment: 0
          totalEvents: 0
          updated_at: '2023-10-13T09:48:33.043Z'
          updated_by:
            email: 'null'
            full_name: 'null'
            profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
            username: elastic
          version: WzU0OCwxXQ==
    Cases_update_comment_request:
      summary: Updates a comment of a case.
      value:
        comment: An updated comment.
        id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
        owner: cases
        type: user
        version: Wzk1LDFd
    Cases_update_comment_response:
      summary: The add comment to case API returns a JSON object that contains details about the case and its comments.
      value:
        assignees: [ ]
        category: 'null'
        closed_at: 'null'
        closed_by: 'null'
        comments:
          - comment: An updated comment.
            created_at: '2023-10-24T00:37:10.832Z'
            created_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            id: 8af6ac20-74f6-11ea-b83a-553aecdb28b6
            owner: cases
            pushed_at: 'null'
            pushed_by: 'null'
            type: user
            updated_at: '2023-10-24T01:27:06.210Z'
            updated_by:
              email: 'null'
              full_name: 'null'
              profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
              username: elastic
            version: WzIwNjM3LDFd
        connector:
          fields: 'null'
          id: none
          name: none
          type: .none
        created_at: '2023-10-24T00:37:03.906Z'
        created_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        customFields:
          - key: d312efda-ec2b-42ec-9e2c-84981795c581
            type: text
            value: My new field value
          - key: fcc6840d-eb14-42df-8aaf-232201a705ec
            type: toggle
            value: false
        description: A case description.
        duration: 'null'
        external_service: 'null'
        id: 293f1bc0-74f6-11ea-b83a-553aecdb28b6
        owner: cases
        settings:
          syncAlerts: false
        severity: low
        status: open
        tags:
          - tag 1
        title: Case title 1
        totalAlerts: 0
        totalComment: 1
        totalEvents: 0
        updated_at: '2023-10-24T01:27:06.210Z'
        updated_by:
          email: 'null'
          full_name: 'null'
          profile_uid: u_mGBROF_q5bmFCATbLXAcCwKa0k8JvONAwSruelyKA5E_0
          username: elastic
        version: WzIwNjM2LDFd
    Data_views_create_data_view_request:
      summary: Create a data view with runtime fields.
      description: Create a data view for logstash indices that includes a runtime field which extracts the shape name from a source field.
      value:
        data_view:
          name: My Logstash data view
          runtimeFieldMap:
            runtime_shape_name:
              script:
                source: 'emit(doc[''shape_name''].value)'
              type: keyword
          title: logstash-*
    Data_views_create_data_view_response:
      summary: The create data view API returns a JSON object that contains details about the new data view.
      description: 'The response includes the full data view specification, including auto-generated fields such as the unique identifier and version.'
      value:
        data_view:
          allowNoIndex: false
          fieldAttrs: { }
          fieldFormats: { }
          fields:
            runtime_shape_name:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              name: runtime_shape_name
              readFromDocValues: false
              runtimeField:
                script:
                  source: 'emit(doc[''shape_name''].value)'
                type: keyword
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
          id: b561acfb-0181-455e-84a3-ce8980b2272f
          name: My Logstash data view
          namespaces:
            - default
          runtimeFieldMap:
            runtime_shape_name:
              script:
                source: 'emit(doc[''shape_name''].value)'
              type: keyword
          sourceFilters: [ ]
          title: logstash-*
          typeMeta: { }
          version: WzQ5LDJd
    Data_views_create_runtime_field_request:
      summary: Create a runtime field.
      description: Create a long-type runtime field that emits a value derived from the foo source field.
      value:
        name: runtimeFoo
        runtimeField:
          script:
            source: 'emit(doc["foo"].value)'
          type: long
    Data_views_create_runtime_field_response:
      summary: The API returns created runtime field object array and updated data view object.
      description: The response includes the newly created runtime field as an array and the full updated data view object.
      value:
        data_view:
          ...: 'null'
        fields:
          - ...
    Data_views_error_400_response:
      summary: A bad request response.
      description: The request was rejected because the payload or query parameters are missing required fields or contain invalid values.
      value:
        error: Bad Request
        message: '[request body.data_view.title]: expected value of type [string] but got [undefined]'
        statusCode: 400
    Data_views_error_404_response:
      summary: A not found response.
      description: The requested data view or runtime field was not found in the current Kibana space.
      value:
        error: Not Found
        message: 'Saved object [index-pattern/caaad6d0-920c-11ed-b36a-874bd1548a00] not found'
        statusCode: 404
    Data_views_get_data_view_response:
      summary: The get data view API returns a JSON object that contains information about the data view.
      description: 'A complete data view object including all fields, runtime fields, and metadata.'
      value:
        data_view:
          allowNoIndex: false
          fieldAttrs:
            products.manufacturer:
              count: 1
            products.price:
              count: 1
            products.product_name:
              count: 1
            total_quantity:
              count: 1
          fieldFormats:
            products.base_price:
              id: number
              params:
                pattern: '$0,0.00'
            products.base_unit_price:
              id: number
              params:
                pattern: '$0,0.00'
            products.min_price:
              id: number
              params:
                pattern: '$0,0.00'
            products.price:
              id: number
              params:
                pattern: '$0,0.00'
            products.taxful_price:
              id: number
              params:
                pattern: '$0,0.00'
            products.taxless_price:
              id: number
              params:
                pattern: '$0,0.00'
            taxful_total_price:
              id: number
              params:
                pattern: '$0,0.[00]'
            taxless_total_price:
              id: number
              params:
                pattern: '$0,0.00'
          fields:
            _id:
              aggregatable: false
              count: 0
              esTypes:
                - _id
              format:
                id: string
              isMapped: true
              name: _id
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            _index:
              aggregatable: true
              count: 0
              esTypes:
                - _index
              format:
                id: string
              isMapped: true
              name: _index
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            _score:
              aggregatable: false
              count: 0
              format:
                id: number
              isMapped: true
              name: _score
              readFromDocValues: false
              scripted: false
              searchable: false
              shortDotsEnable: false
              type: number
            _source:
              aggregatable: false
              count: 0
              esTypes:
                - _source
              format:
                id: _source
              isMapped: true
              name: _source
              readFromDocValues: false
              scripted: false
              searchable: false
              shortDotsEnable: false
              type: _source
            category:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: category
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            category.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: category.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: category
              type: string
            currency:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: currency
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            customer_birth_date:
              aggregatable: true
              count: 0
              esTypes:
                - date
              format:
                id: date
              isMapped: true
              name: customer_birth_date
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: date
            customer_first_name:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: customer_first_name
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            customer_first_name.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: customer_first_name.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: customer_first_name
              type: string
            customer_full_name:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: customer_full_name
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            customer_full_name.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: customer_full_name.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: customer_full_name
              type: string
            customer_gender:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: customer_gender
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            customer_id:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: customer_id
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            customer_last_name:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: customer_last_name
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            customer_last_name.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: customer_last_name.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: customer_last_name
              type: string
            customer_phone:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: customer_phone
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            day_of_week:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: day_of_week
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            day_of_week_i:
              aggregatable: true
              count: 0
              esTypes:
                - integer
              format:
                id: number
              isMapped: true
              name: day_of_week_i
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            email:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: email
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            event.dataset:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: event.dataset
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            geoip.city_name:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: geoip.city_name
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            geoip.continent_name:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: geoip.continent_name
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            geoip.country_iso_code:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: geoip.country_iso_code
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            geoip.location:
              aggregatable: true
              count: 0
              esTypes:
                - geo_point
              format:
                id: geo_point
                params:
                  transform: wkt
              isMapped: true
              name: geoip.location
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: geo_point
            geoip.region_name:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: geoip.region_name
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            manufacturer:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: manufacturer
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            manufacturer.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: manufacturer.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: manufacturer
              type: string
            order_date:
              aggregatable: true
              count: 0
              esTypes:
                - date
              format:
                id: date
              isMapped: true
              name: order_date
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: date
            order_id:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: order_id
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            products._id:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: products._id
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            products._id.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: products._id.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: products._id
              type: string
            products.base_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: products.base_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.base_unit_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: products.base_unit_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.category:
              aggregatable: false
              count: 0
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: products.category
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            products.category.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: products.category.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: products.category
              type: string
            products.created_on:
              aggregatable: true
              count: 0
              esTypes:
                - date
              format:
                id: date
              isMapped: true
              name: products.created_on
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: date
            products.discount_amount:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
              isMapped: true
              name: products.discount_amount
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.discount_percentage:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
              isMapped: true
              name: products.discount_percentage
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.manufacturer:
              aggregatable: false
              count: 1
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: products.manufacturer
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            products.manufacturer.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: products.manufacturer.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: products.manufacturer
              type: string
            products.min_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: products.min_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.price:
              aggregatable: true
              count: 1
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: products.price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.product_id:
              aggregatable: true
              count: 0
              esTypes:
                - long
              format:
                id: number
              isMapped: true
              name: products.product_id
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.product_name:
              aggregatable: false
              count: 1
              esTypes:
                - text
              format:
                id: string
              isMapped: true
              name: products.product_name
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            products.product_name.keyword:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: products.product_name.keyword
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              subType:
                multi:
                  parent: products.product_name
              type: string
            products.quantity:
              aggregatable: true
              count: 0
              esTypes:
                - integer
              format:
                id: number
              isMapped: true
              name: products.quantity
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.sku:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: products.sku
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            products.tax_amount:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
              isMapped: true
              name: products.tax_amount
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.taxful_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: products.taxful_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.taxless_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: products.taxless_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            products.unit_discount_amount:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
              isMapped: true
              name: products.unit_discount_amount
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            sku:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: sku
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            taxful_total_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.[00]'
              isMapped: true
              name: taxful_total_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            taxless_total_price:
              aggregatable: true
              count: 0
              esTypes:
                - half_float
              format:
                id: number
                params:
                  pattern: '$0,0.00'
              isMapped: true
              name: taxless_total_price
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            total_quantity:
              aggregatable: true
              count: 1
              esTypes:
                - integer
              format:
                id: number
              isMapped: true
              name: total_quantity
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            total_unique_products:
              aggregatable: true
              count: 0
              esTypes:
                - integer
              format:
                id: number
              isMapped: true
              name: total_unique_products
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            type:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: type
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            user:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: user
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
          id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
          name: Kibana Sample Data eCommerce
          namespaces:
            - default
          runtimeFieldMap: { }
          sourceFilters: [ ]
          timeFieldName: order_date
          title: kibana_sample_data_ecommerce
          typeMeta: { }
          version: WzUsMV0=
    Data_views_get_data_views_response:
      summary: The get all data views API returns a list of data views.
      description: 'A list of available data views including their identifiers, names, and index patterns.'
      value:
        data_view:
          - id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
            name: Kibana Sample Data eCommerce
            namespaces:
              - default
            title: kibana_sample_data_ecommerce
            typeMeta: { }
          - id: d3d7af60-4c81-11e8-b3d7-01146121b73d
            name: Kibana Sample Data Flights
            namespaces:
              - default
            title: kibana_sample_data_flights
          - id: 90943e30-9a47-11e8-b64d-95841ca0b247
            name: Kibana Sample Data Logs
            namespaces:
              - default
            title: kibana_sample_data_logs
    Data_views_get_default_data_view_response:
      summary: The get default data view API returns the default data view identifier.
      description: The identifier of the default data view for the current Kibana space.
      value:
        data_view_id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
    Data_views_get_runtime_field_response:
      summary: The get runtime field API returns a JSON object that contains information about the runtime field (`hour_of_day`) and the data view (`d3d7af60-4c81-11e8-b3d7-01146121b73d`).
      description: The runtime field definition along with the parent data view.
      value:
        data_view:
          allowNoIndex: false
          fieldAttrs: { }
          fieldFormats:
            AvgTicketPrice:
              id: number
              params:
                pattern: '$0,0.[00]'
            hour_of_day:
              id: number
              params:
                pattern: '00'
          fields:
            _id:
              aggregatable: false
              count: 0
              esTypes:
                - _id
              format:
                id: string
              isMapped: true
              name: _id
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            _index:
              aggregatable: true
              count: 0
              esTypes:
                - _index
              format:
                id: string
              isMapped: true
              name: _index
              readFromDocValues: false
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            _score:
              aggregatable: false
              count: 0
              format:
                id: number
              isMapped: true
              name: _score
              readFromDocValues: false
              scripted: false
              searchable: false
              shortDotsEnable: false
              type: number
            _source:
              aggregatable: false
              count: 0
              esTypes:
                - _source
              format:
                id: _source
              isMapped: true
              name: _source
              readFromDocValues: false
              scripted: false
              searchable: false
              shortDotsEnable: false
              type: _source
            AvgTicketPrice:
              aggregatable: true
              count: 0
              esTypes:
                - float
              format:
                id: number
                params:
                  pattern: '$0,0.[00]'
              isMapped: true
              name: AvgTicketPrice
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            Cancelled:
              aggregatable: true
              count: 0
              esTypes:
                - boolean
              format:
                id: boolean
              isMapped: true
              name: Cancelled
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: boolean
            Carrier:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: Carrier
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            dayOfWeek:
              aggregatable: true
              count: 0
              esTypes:
                - integer
              format:
                id: number
              isMapped: true
              name: dayOfWeek
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            Dest:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: Dest
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            DestAirportID:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: DestAirportID
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            DestCityName:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: DestCityName
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            DestCountry:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: DestCountry
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            DestLocation:
              aggregatable: true
              count: 0
              esTypes:
                - geo_point
              format:
                id: geo_point
                params:
                  transform: wkt
              isMapped: true
              name: DestLocation
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: geo_point
            DestRegion:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: DestRegion
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            DestWeather:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: DestWeather
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            DistanceKilometers:
              aggregatable: true
              count: 0
              esTypes:
                - float
              format:
                id: number
              isMapped: true
              name: DistanceKilometers
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            DistanceMiles:
              aggregatable: true
              count: 0
              esTypes:
                - float
              format:
                id: number
              isMapped: true
              name: DistanceMiles
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            FlightDelay:
              aggregatable: true
              count: 0
              esTypes:
                - boolean
              format:
                id: boolean
              isMapped: true
              name: FlightDelay
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: boolean
            FlightDelayMin:
              aggregatable: true
              count: 0
              esTypes:
                - integer
              format:
                id: number
              isMapped: true
              name: FlightDelayMin
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            FlightDelayType:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: FlightDelayType
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            FlightNum:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: FlightNum
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            FlightTimeHour:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: FlightTimeHour
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            FlightTimeMin:
              aggregatable: true
              count: 0
              esTypes:
                - float
              format:
                id: number
              isMapped: true
              name: FlightTimeMin
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            hour_of_day:
              aggregatable: true
              count: 0
              esTypes:
                - long
              format:
                id: number
                params:
                  pattern: '00'
              name: hour_of_day
              readFromDocValues: false
              runtimeField:
                script:
                  source: 'emit(doc[''timestamp''].value.getHour());'
                type: long
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: number
            Origin:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: Origin
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            OriginAirportID:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: OriginAirportID
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            OriginCityName:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: OriginCityName
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            OriginCountry:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: OriginCountry
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            OriginLocation:
              aggregatable: true
              count: 0
              esTypes:
                - geo_point
              format:
                id: geo_point
                params:
                  transform: wkt
              isMapped: true
              name: OriginLocation
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: geo_point
            OriginRegion:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: OriginRegion
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            OriginWeather:
              aggregatable: true
              count: 0
              esTypes:
                - keyword
              format:
                id: string
              isMapped: true
              name: OriginWeather
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: string
            timestamp:
              aggregatable: true
              count: 0
              esTypes:
                - date
              format:
                id: date
              isMapped: true
              name: timestamp
              readFromDocValues: true
              scripted: false
              searchable: true
              shortDotsEnable: false
              type: date
          id: d3d7af60-4c81-11e8-b3d7-01146121b73d
          name: Kibana Sample Data Flights
          runtimeFieldMap:
            hour_of_day:
              script:
                source: 'emit(doc[''timestamp''].value.getHour());'
              type: long
          sourceFilters: [ ]
          timeFieldName: timestamp
          title: kibana_sample_data_flights
          version: WzM2LDJd
        fields:
          - aggregatable: true
            count: 0
            esTypes:
              - long
            name: hour_of_day
            readFromDocValues: false
            runtimeField:
              script:
                source: 'emit(doc[''timestamp''].value.getHour());'
              type: long
            scripted: false
            searchable: true
            shortDotsEnable: false
            type: number
    Data_views_preview_swap_data_view_request:
      summary: Preview swapping references from data view ID "abcd-efg" to "xyz-123".
      description: Preview the saved objects that would be affected by swapping references from one data view to another.
      value:
        fromId: abcd-efg
        toId: xyz-123
    Data_views_preview_swap_data_view_response:
      summary: A preview of saved objects that would be affected by a data view swap.
      description: The result array lists every saved object that references the source data view. No saved objects are modified by the preview endpoint.
      value:
        result:
          - id: 8963ca30-bca7-11e8-aa00-0123456789ab
            type: visualization
          - id: edf84fe0-e1a0-11e7-b6d5-4dc382ef7f5b
            type: dashboard
    Data_views_set_default_data_view_request:
      summary: Set the default data view identifier.
      description: 'Set the default data view, using the force flag to overwrite an existing default.'
      value:
        data_view_id: ff959d40-b880-11e8-a6d9-e546fe2bba5f
        force: true
    Data_views_set_default_data_view_response:
      summary: The default data view was set successfully.
      description: The acknowledged flag confirms that the default data view for the current Kibana space was updated.
      value:
        acknowledged: true
    Data_views_swap_data_view_request:
      summary: Swap references from data view ID "abcd-efg" to "xyz-123" and remove the data view that is no longer referenced.
      description: Swap all saved object references from one data view to another and delete the source data view afterward.
      value:
        delete: true
        fromId: abcd-efg
        toId: xyz-123
    Data_views_swap_data_view_response:
      summary: The swap references API returns a list of the affected saved objects.
      description: 'The list of saved objects whose references were updated, along with the delete status of the source.'
      value:
        deleteStatus:
          deletePerformed: true
          remainingRefs: 0
        result:
          - id: '123'
            type: visualization
    Data_views_update_data_view_request:
      summary: Update some properties for a data view.
      description: 'Update the title, time field, and other properties of an existing data view.'
      value:
        data_view:
          allowNoIndex: false
          name: Kibana Sample Data eCommerce
          timeFieldName: order_date
          title: kibana_sample_data_ecommerce
        refresh_fields: true
    Data_views_update_field_metadata_request:
      summary: Update metadata for multiple fields.
      description: 'Update the popularity count, custom label, and custom description for specific fields in a data view.'
      value:
        fields:
          field1:
            count: 123
            customLabel: Field 1 label
          field2:
            customDescription: Field 2 description
            customLabel: Field 2 label
    Data_views_update_field_metadata_response:
      summary: Field metadata was updated successfully.
      description: The acknowledged flag confirms that the field metadata changes were applied to the data view.
      value:
        acknowledged: true
    Data_views_update_runtime_field_request:
      summary: Update an existing runtime field on a data view.
      description: Update the script of an existing runtime field.
      value:
        runtimeField:
          script:
            source: 'emit(doc["bar"].value)'
    Machine_learning_APIs_mlSync401Example:
      summary: Two anomaly detection jobs required synchronization in this example.
      value:
        error: Unauthorized
        message: "[security_exception\n\tRoot causes:\n\t\tsecurity_exception: unable to authenticate user [ml_viewer] for REST request [/_security/_authenticate]]: unable to authenticate user [ml_viewer] for REST request [/_security/_authenticate]"
        statusCode: 401
    Machine_learning_APIs_mlSyncExample:
      summary: Two anomaly detection jobs required synchronization in this example.
      value:
        datafeedsAdded: { }
        datafeedsRemoved: { }
        savedObjectsCreated:
          anomaly-detector:
            myjob1:
              success: true
            myjob2:
              success: true
        savedObjectsDeleted: { }
    Observability_AI_Assistant_API_ChatCompleteRequestExample:
      summary: Example of completing a chat interaction
      value: "{\n  \"connectorId\": \"<connectorId>\",\n  \"disableFunctions\": false,\n  \"messages\": [\n    {\n      \"@timestamp\": \"2025-06-25T23:45:00.000Z\",\n      \"message\": {\n        \"role\": \"user\",\n        \"content\": \"Is my Elasticsearch cluster healthy right now?\"\n      }\n    }\n  ],\n  \"persist\": false,\n  \"actions\": [\n    {\n      \"name\": \"get_cluster_health\",\n      \"description\": \"Fetch the current Elasticsearch cluster-health status and key metrics.\",\n      \"parameters\": {\n        \"type\": \"object\",\n        \"properties\": {\n          \"includeShardStats\": {\n            \"type\": \"boolean\",\n            \"default\": false\n          }\n        }\n      }\n    }\n  ],\n  \"instructions\": [\"When the user asks about Elasticsearch cluster health, use the get_cluster_health tool to retrieve cluster health, then summarize the response in plain English.\"]\n}\n"
    Observability_AI_Assistant_API_ChatCompleteResponseExample:
      summary: Get a chat completion from the Observability AI Assistant
      value: "data: {\"model\":\"unknown\",\"choices\":[{\"delta\":{\"content\":\"\",\"function_call\":{\"name\":\"get_cluster_health\",\"arguments\":\"{\\\"includeShardStats\\\":true}\"}},\"finish_reason\":null,\"index\":0}],\"created\":1750936626911,\"id\":\"9c8eff9b-4fd4-4203-a4ab-2e364688deff\",\"object\":\"chat.completion.chunk\"}\n\ndata: [DONE]\n"
    Saved_objects_key_rotation_response:
      summary: Encryption key rotation using default parameters.
      value:
        failed: 0
        successful: 300
        total: 1000
    Security_Detections_API_SetAlertAssigneesBodyAdd:
      value:
        assignees:
          add:
            - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
          remove: [ ]
        ids:
          - 681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
    Security_Detections_API_SetAlertAssigneesBodyRemove:
      value:
        assignees:
          add: [ ]
          remove:
            - u_MxY0jbrft7EcfC6iNZSUGeI_n6iYrSwZj5mWF5EqmSU_0
        ids:
          - 681c2a707335aa7df5f349b70013d87254746191712ecf0ced9b3e2d538503a6
    Security_Detections_API_SetAlertTagsBodyAdd:
      value:
        ids:
          - 549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
        tags:
          tags_to_add:
            - Duplicate
          tags_to_remove: [ ]
    Security_Detections_API_SetAlertTagsBodyRemove:
      value:
        ids:
          - 549c7129c76cbd554aba1bd638f8a49dde95088f5832e50218358e7eca1cf16e
        tags:
          tags_to_add: [ ]
          tags_to_remove:
            - Duplicate
    Task_manager_health_APIs_health_200response:
      description: A successful response from `GET api/task_manager/_health`.
      value: "{\n  \"id\": \"330bbc6a-56cd-44d5-88e3-e3229f14d619\",\n  \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n  \"status\": \"OK\",\n  \"last_update\": \"2025-03-21T21:30:04.455Z\",\n  \"stats\": {\n    \"configuration\": {\n      \"timestamp\": \"2025-03-21T21:26:10.002Z\",\n      \"value\": {\n        \"request_capacity\": 1000,\n        \"monitored_aggregated_stats_refresh_rate\": 60000,\n        \"monitored_stats_running_average_window\": 50,\n        \"monitored_task_execution_thresholds\": {\n          \"custom\": {},\n          \"default\": {\n            \"error_threshold\": 90,\n            \"warn_threshold\": 80\n          }\n        },\n        \"claim_strategy\": \"mget\",\n        \"poll_interval\": 500,\n        \"capacity\": {\n          \"config\": 10,\n          \"as_workers\": 10,\n          \"as_cost\": 20\n        }\n      },\n      \"status\": \"OK\"\n    },\n    \"runtime\": {\n      \"timestamp\": \"2025-03-21T21:30:04.455Z\",\n      \"value\": {\n        \"polling\": {\n          \"last_successful_poll\": \"2025-03-21T21:30:04.455Z\",\n          \"last_polling_delay\": \"2025-03-21T21:26:10.001Z\",\n          \"claim_duration\": {\n            \"p50\": 17,\n            \"p90\": 22,\n            \"p95\": 25,\n            \"p99\": 27\n          },\n          \"duration\": {\n            \"p50\": 19,\n            \"p90\": 25.5,\n            \"p95\": 28,\n            \"p99\": 28\n          },\n          \"claim_conflicts\": {\n            \"p50\": 0,\n            \"p90\": 0,\n            \"p95\": 0,\n            \"p99\": 0\n          },\n          \"claim_mismatches\": {\n            \"p50\": 0,\n            \"p90\": 0,\n            \"p95\": 0,\n            \"p99\": 0\n          },\n          \"claim_stale_tasks\": {\n            \"p50\": 0,\n            \"p90\": 0,\n            \"p95\": 0,\n            \"p99\": 0\n          },\n          \"result_frequency_percent_as_number\": {\n            \"Failed\": 0,\n            \"NoAvailableWorkers\": 0,\n            \"NoTasksClaimed\": 100,\n            \"RanOutOfCapacity\": 0,\n            \"RunningAtCapacity\": 0,\n            \"PoolFilled\": 0\n          },\n          \"persistence\": {\n            \"recurring\": 88,\n            \"non_recurring\": 12\n          }\n        },\n        \"drift\": {\n          \"p50\": 2089,\n          \"p90\": 3037,\n          \"p95\": 3037,\n          \"p99\": 3037\n        },\n        \"drift_by_type\": {\n          \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n            \"p50\": 2082,\n            \"p90\": 2082,\n            \"p95\": 2082,\n            \"p99\": 2082\n          },\n          \"fleet:check-deleted-files-task\": {\n            \"p50\": 2080,\n            \"p90\": 2080,\n            \"p95\": 2080,\n            \"p99\": 2080\n          },\n          \"osquery:telemetry-saved-queries\": {\n            \"p50\": 2080,\n            \"p90\": 2080,\n            \"p95\": 2080,\n            \"p99\": 2080\n          },\n          \"task_manager:mark_removed_tasks_as_unrecognized\": {\n            \"p50\": 2089,\n            \"p90\": 2089,\n            \"p95\": 2089,\n            \"p99\": 2089\n          },\n          \"task_manager:delete_inactive_background_task_nodes\": {\n            \"p50\": 336.5,\n            \"p90\": 2089,\n            \"p95\": 2089,\n            \"p99\": 2089\n          },\n          \"alerts_invalidate_api_keys\": {\n            \"p50\": 2086,\n            \"p90\": 2086,\n            \"p95\": 2086,\n            \"p99\": 2086\n          },\n          \"fleet:unenroll-inactive-agents-task\": {\n            \"p50\": 2080,\n            \"p90\": 2080,\n            \"p95\": 2080,\n            \"p99\": 2080\n          },\n          \"alerting_health_check\": {\n            \"p50\": 2086,\n            \"p90\": 2086,\n            \"p95\": 2086,\n            \"p99\": 2086\n          },\n          \"Fleet-Usage-Sender\": {\n            \"p50\": 2079,\n            \"p90\": 2079,\n            \"p95\": 2079,\n            \"p99\": 2079\n          },\n          \"security:endpoint-diagnostics\": {\n            \"p50\": 2525,\n            \"p90\": 2525,\n            \"p95\": 2525,\n            \"p99\": 2525\n          },\n          \"security:telemetry-lists\": {\n            \"p50\": 2525,\n            \"p90\": 2525,\n            \"p95\": 2525,\n            \"p99\": 2525\n          },\n          \"security:telemetry-timelines\": {\n            \"p50\": 2526,\n            \"p90\": 2526,\n            \"p95\": 2526,\n            \"p99\": 2526\n          },\n          \"cases-telemetry-task\": {\n            \"p50\": 2083,\n            \"p90\": 2083,\n            \"p95\": 2083,\n            \"p99\": 2083\n          },\n          \"osquery:telemetry-packs\": {\n            \"p50\": 2530,\n            \"p90\": 2530,\n            \"p95\": 2530,\n            \"p99\": 2530\n          },\n          \"Fleet-Metrics-Task\": {\n            \"p50\": 133.5,\n            \"p90\": 2530,\n            \"p95\": 2530,\n            \"p99\": 2530\n          },\n          \"fleet:delete-unenrolled-agents-task\": {\n            \"p50\": 2530,\n            \"p90\": 2530,\n            \"p95\": 2530,\n            \"p99\": 2530\n          },\n          \"osquery:telemetry-configs\": {\n            \"p50\": 2529,\n            \"p90\": 2529,\n            \"p95\": 2529,\n            \"p99\": 2529\n          },\n          \"endpoint:complete-external-response-actions\": {\n            \"p50\": 519,\n            \"p90\": 2526,\n            \"p95\": 2526,\n            \"p99\": 2526\n          },\n          \"security:telemetry-detection-rules\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"security:telemetry-prebuilt-rule-alerts\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"security:endpoint-meta-telemetry\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"security:telemetry-filterlist-artifact\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"security:telemetry-diagnostic-timelines\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"security:telemetry-configuration\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"security:indices-metadata-telemetry\": {\n            \"p50\": 3037,\n            \"p90\": 3037,\n            \"p95\": 3037,\n            \"p99\": 3037\n          },\n          \"Fleet-Usage-Logger\": {\n            \"p50\": 2190,\n            \"p90\": 2190,\n            \"p95\": 2190,\n            \"p99\": 2190\n          },\n          \"obs-ai-assistant:knowledge-base-migration\": {\n            \"p50\": 2189,\n            \"p90\": 2189,\n            \"p95\": 2189,\n            \"p99\": 2189\n          },\n          \"dashboard_telemetry\": {\n            \"p50\": 2452,\n            \"p90\": 2452,\n            \"p95\": 2452,\n            \"p99\": 2452\n          },\n          \"session_cleanup\": {\n            \"p50\": 2569,\n            \"p90\": 2569,\n            \"p95\": 2569,\n            \"p99\": 2569\n          },\n          \"ProductDocBase:EnsureUpToDate\": {\n            \"p50\": 2452,\n            \"p90\": 2452,\n            \"p95\": 2452,\n            \"p99\": 2452\n          },\n          \"apm-telemetry-task\": {\n            \"p50\": 2591,\n            \"p90\": 2591,\n            \"p95\": 2591,\n            \"p99\": 2591\n          },\n          \"ML:saved-objects-sync\": {\n            \"p50\": 2475,\n            \"p90\": 2475,\n            \"p95\": 2475,\n            \"p99\": 2475\n          },\n          \"apm-source-map-migration-task\": {\n            \"p50\": 1603.5,\n            \"p90\": 2987,\n            \"p95\": 2987,\n            \"p99\": 2987\n          },\n          \"actions_telemetry\": {\n            \"p50\": 771,\n            \"p90\": 771,\n            \"p95\": 771,\n            \"p99\": 771\n          },\n          \"alerting_telemetry\": {\n            \"p50\": 768,\n            \"p90\": 768,\n            \"p95\": 768,\n            \"p99\": 768\n          },\n          \"endpoint:metadata-check-transforms-task\": {\n            \"p50\": 834,\n            \"p90\": 834,\n            \"p95\": 834,\n            \"p99\": 834\n          },\n          \"endpoint:user-artifact-packager\": {\n            \"p50\": 529.5,\n            \"p90\": 835,\n            \"p95\": 835,\n            \"p99\": 835\n          },\n          \"fleet:bump_agent_policies\": {\n            \"p50\": 361,\n            \"p90\": 361,\n            \"p95\": 361,\n            \"p99\": 361\n          }\n        },\n        \"load\": {\n          \"p50\": 10,\n          \"p90\": 100,\n          \"p95\": 100,\n          \"p99\": 100\n        },\n        \"execution\": {\n          \"duration\": {\n            \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n              \"p50\": 24,\n              \"p90\": 24,\n              \"p95\": 24,\n              \"p99\": 24\n            },\n            \"fleet:check-deleted-files-task\": {\n              \"p50\": 24,\n              \"p90\": 24,\n              \"p95\": 24,\n              \"p99\": 24\n            },\n            \"osquery:telemetry-saved-queries\": {\n              \"p50\": 25,\n              \"p90\": 25,\n              \"p95\": 25,\n              \"p99\": 25\n            },\n            \"task_manager:mark_removed_tasks_as_unrecognized\": {\n              \"p50\": 28,\n              \"p90\": 28,\n              \"p95\": 28,\n              \"p99\": 28\n            },\n            \"task_manager:delete_inactive_background_task_nodes\": {\n              \"p50\": 7.5,\n              \"p90\": 29,\n              \"p95\": 29,\n              \"p99\": 29\n            },\n            \"alerts_invalidate_api_keys\": {\n              \"p50\": 34,\n              \"p90\": 34,\n              \"p95\": 34,\n              \"p99\": 34\n            },\n            \"fleet:unenroll-inactive-agents-task\": {\n              \"p50\": 39,\n              \"p90\": 39,\n              \"p95\": 39,\n              \"p99\": 39\n            },\n            \"alerting_health_check\": {\n              \"p50\": 42,\n              \"p90\": 42,\n              \"p95\": 42,\n              \"p99\": 42\n            },\n            \"Fleet-Usage-Sender\": {\n              \"p50\": 78,\n              \"p90\": 78,\n              \"p95\": 78,\n              \"p99\": 78\n            },\n            \"security:endpoint-diagnostics\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"security:telemetry-lists\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"security:telemetry-timelines\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"cases-telemetry-task\": {\n              \"p50\": 458,\n              \"p90\": 458,\n              \"p95\": 458,\n              \"p99\": 458\n            },\n            \"osquery:telemetry-packs\": {\n              \"p50\": 10,\n              \"p90\": 10,\n              \"p95\": 10,\n              \"p99\": 10\n            },\n            \"Fleet-Metrics-Task\": {\n              \"p50\": 5,\n              \"p90\": 10,\n              \"p95\": 10,\n              \"p99\": 10\n            },\n            \"fleet:delete-unenrolled-agents-task\": {\n              \"p50\": 11,\n              \"p90\": 11,\n              \"p95\": 11,\n              \"p99\": 11\n            },\n            \"osquery:telemetry-configs\": {\n              \"p50\": 12,\n              \"p90\": 12,\n              \"p95\": 12,\n              \"p99\": 12\n            },\n            \"endpoint:complete-external-response-actions\": {\n              \"p50\": 7,\n              \"p90\": 11,\n              \"p95\": 11,\n              \"p99\": 11\n            },\n            \"security:telemetry-detection-rules\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"security:telemetry-prebuilt-rule-alerts\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"security:endpoint-meta-telemetry\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"security:telemetry-filterlist-artifact\": {\n              \"p50\": 5,\n              \"p90\": 5,\n              \"p95\": 5,\n              \"p99\": 5\n            },\n            \"security:telemetry-diagnostic-timelines\": {\n              \"p50\": 5,\n              \"p90\": 5,\n              \"p95\": 5,\n              \"p99\": 5\n            },\n            \"security:telemetry-configuration\": {\n              \"p50\": 5,\n              \"p90\": 5,\n              \"p95\": 5,\n              \"p99\": 5\n            },\n            \"security:indices-metadata-telemetry\": {\n              \"p50\": 5,\n              \"p90\": 5,\n              \"p95\": 5,\n              \"p99\": 5\n            },\n            \"Fleet-Usage-Logger\": {\n              \"p50\": 18,\n              \"p90\": 18,\n              \"p95\": 18,\n              \"p99\": 18\n            },\n            \"obs-ai-assistant:knowledge-base-migration\": {\n              \"p50\": 8,\n              \"p90\": 8,\n              \"p95\": 8,\n              \"p99\": 8\n            },\n            \"dashboard_telemetry\": {\n              \"p50\": 12,\n              \"p90\": 12,\n              \"p95\": 12,\n              \"p99\": 12\n            },\n            \"session_cleanup\": {\n              \"p50\": 58,\n              \"p90\": 58,\n              \"p95\": 58,\n              \"p99\": 58\n            },\n            \"ProductDocBase:EnsureUpToDate\": {\n              \"p50\": 147,\n              \"p90\": 147,\n              \"p95\": 147,\n              \"p99\": 147\n            },\n            \"apm-telemetry-task\": {\n              \"p50\": 543,\n              \"p90\": 543,\n              \"p95\": 543,\n              \"p99\": 543\n            },\n            \"ML:saved-objects-sync\": {\n              \"p50\": 544,\n              \"p90\": 544,\n              \"p95\": 544,\n              \"p99\": 544\n            },\n            \"apm-source-map-migration-task\": {\n              \"p50\": 1649,\n              \"p90\": 3282,\n              \"p95\": 3282,\n              \"p99\": 3282\n            },\n            \"actions_telemetry\": {\n              \"p50\": 19,\n              \"p90\": 19,\n              \"p95\": 19,\n              \"p99\": 19\n            },\n            \"alerting_telemetry\": {\n              \"p50\": 64,\n              \"p90\": 64,\n              \"p95\": 64,\n              \"p99\": 64\n            },\n            \"endpoint:metadata-check-transforms-task\": {\n              \"p50\": 6,\n              \"p90\": 6,\n              \"p95\": 6,\n              \"p99\": 6\n            },\n            \"endpoint:user-artifact-packager\": {\n              \"p50\": 10,\n              \"p90\": 13,\n              \"p95\": 13,\n              \"p99\": 13\n            },\n            \"fleet:bump_agent_policies\": {\n              \"p50\": 9,\n              \"p90\": 9,\n              \"p95\": 9,\n              \"p99\": 9\n            }\n          },\n          \"duration_by_persistence\": {\n            \"recurring\": {\n              \"p50\": 9,\n              \"p90\": 63.39999999999999,\n              \"p95\": 474.99999999999966,\n              \"p99\": 544\n            },\n            \"non_recurring\": {\n              \"p50\": 14,\n              \"p90\": 2968.500000000001,\n              \"p95\": 3282,\n              \"p99\": 3282\n            }\n          },\n          \"persistence\": {\n            \"recurring\": 88,\n            \"non_recurring\": 12\n          },\n          \"result_frequency_percent_as_number\": {\n            \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"fleet:check-deleted-files-task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"osquery:telemetry-saved-queries\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"task_manager:mark_removed_tasks_as_unrecognized\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"task_manager:delete_inactive_background_task_nodes\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"alerts_invalidate_api_keys\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"fleet:unenroll-inactive-agents-task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"alerting_health_check\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"Fleet-Usage-Sender\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:endpoint-diagnostics\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-lists\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-timelines\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"cases-telemetry-task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"osquery:telemetry-packs\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"Fleet-Metrics-Task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"fleet:delete-unenrolled-agents-task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"osquery:telemetry-configs\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"endpoint:complete-external-response-actions\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-detection-rules\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-prebuilt-rule-alerts\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:endpoint-meta-telemetry\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-filterlist-artifact\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-diagnostic-timelines\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:telemetry-configuration\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"security:indices-metadata-telemetry\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"Fleet-Usage-Logger\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"obs-ai-assistant:knowledge-base-migration\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"dashboard_telemetry\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"session_cleanup\": {\n              \"Success\": 0,\n              \"RetryScheduled\": 100,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"ProductDocBase:EnsureUpToDate\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"apm-telemetry-task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"ML:saved-objects-sync\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"apm-source-map-migration-task\": {\n              \"Success\": 50,\n              \"RetryScheduled\": 50,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"actions_telemetry\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"alerting_telemetry\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"endpoint:metadata-check-transforms-task\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"endpoint:user-artifact-packager\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            },\n            \"fleet:bump_agent_policies\": {\n              \"Success\": 100,\n              \"RetryScheduled\": 0,\n              \"Failed\": 0,\n              \"status\": \"OK\"\n            }\n          }\n        }\n      },\n      \"status\": \"OK\"\n    },\n    \"workload\": {\n      \"timestamp\": \"2025-03-21T21:29:10.367Z\",\n      \"value\": {\n        \"count\": 35,\n        \"cost\": 70,\n        \"task_types\": {\n          \"Fleet-Metrics-Task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"Fleet-Usage-Logger\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"Fleet-Usage-Sender\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"ML:saved-objects-sync\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"SLO:ORPHAN_SUMMARIES-CLEANUP-TASK\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"actions_telemetry\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"alerting_health_check\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"alerting_telemetry\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"alerts_invalidate_api_keys\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"apm-telemetry-task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"cases-telemetry-task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"dashboard_telemetry\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"endpoint:complete-external-response-actions\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"endpoint:metadata-check-transforms-task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"endpoint:user-artifact-packager\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"fleet:check-deleted-files-task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"fleet:delete-unenrolled-agents-task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"fleet:unenroll-inactive-agents-task\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"osquery:telemetry-configs\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"osquery:telemetry-packs\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"osquery:telemetry-saved-queries\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:endpoint-diagnostics\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:endpoint-meta-telemetry\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:indices-metadata-telemetry\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-configuration\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-detection-rules\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-diagnostic-timelines\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-filterlist-artifact\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-lists\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-prebuilt-rule-alerts\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"security:telemetry-timelines\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"session_cleanup\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"task_manager:delete_inactive_background_task_nodes\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          },\n          \"task_manager:mark_removed_tasks_as_unrecognized\": {\n            \"count\": 1,\n            \"cost\": 2,\n            \"status\": {\n              \"idle\": 1\n            }\n          }\n        },\n        \"non_recurring\": 1,\n        \"non_recurring_cost\": 2,\n        \"schedule\": [\n          [\n            \"1m\",\n            2\n          ],\n          [\n            \"60s\",\n            2\n          ],\n          [\n            \"5m\",\n            2\n          ],\n          [\n            \"10m\",\n            1\n          ],\n          [\n            \"15m\",\n            1\n          ],\n          [\n            \"45m\",\n            1\n          ],\n          [\n            \"1h\",\n            9\n          ],\n          [\n            \"3600s\",\n            1\n          ],\n          [\n            \"60m\",\n            1\n          ],\n          [\n            \"2h\",\n            1\n          ],\n          [\n            \"720m\",\n            2\n          ],\n          [\n            \"24h\",\n            7\n          ],\n          [\n            \"1d\",\n            3\n          ],\n          [\n            \"1440m\",\n            1\n          ]\n        ],\n        \"overdue\": 0,\n        \"overdue_cost\": 0,\n        \"overdue_non_recurring\": 0,\n        \"estimated_schedule_density\": [\n          0,\n          0,\n          0,\n          1,\n          1,\n          1,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          1,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0,\n          0\n        ],\n        \"capacity_requirements\": {\n          \"per_minute\": 4,\n          \"per_hour\": 46,\n          \"per_day\": 27\n        }\n      },\n      \"status\": \"OK\"\n    },\n    \"capacity_estimation\": {\n      \"status\": \"OK\",\n      \"reason\": \"Task Manager is healthy, the assumedRequiredThroughputPerMinutePerKibana (148.78541666666666) < capacityPerMinutePerKibana (1200)\",\n      \"timestamp\": \"2025-03-21T21:30:04.780Z\",\n      \"value\": {\n        \"observed\": {\n          \"observed_kibana_instances\": 1,\n          \"max_throughput_per_minute_per_kibana\": 1200,\n          \"max_throughput_per_minute\": 1200,\n          \"minutes_to_drain_overdue\": 0,\n          \"avg_recurring_required_throughput_per_minute\": 5,\n          \"avg_recurring_required_throughput_per_minute_per_kibana\": 5,\n          \"avg_required_throughput_per_minute\": 149,\n          \"avg_required_throughput_per_minute_per_kibana\": 149\n        },\n        \"proposed\": {\n          \"provisioned_kibana\": 2,\n          \"min_required_kibana\": 1,\n          \"avg_recurring_required_throughput_per_minute_per_kibana\": 3,\n          \"avg_required_throughput_per_minute_per_kibana\": 75\n        }\n      }\n    }\n  }\n}"
    get_connector_types_generativeai_response:
      summary: A list of connector types for the `generativeAI` feature.
      value:
        - id: .gen-ai
          name: OpenAI
          enabled: true
          enabled_in_config: true
          enabled_in_license: true
          minimum_license_required: enterprise
          supported_feature_ids:
            - generativeAIForSecurity
            - generativeAIForObservability
            - generativeAIForSearchPlayground
          is_system_action_type: false
        - id: .bedrock
          name: AWS Bedrock
          enabled: true
          enabled_in_config: true
          enabled_in_license: true
          minimum_license_required: enterprise
          supported_feature_ids:
            - generativeAIForSecurity
            - generativeAIForObservability
            - generativeAIForSearchPlayground
          is_system_action_type: false
        - id: .gemini
          name: Google Gemini
          enabled: true
          enabled_in_config: true
          enabled_in_license: true
          minimum_license_required: enterprise
          supported_feature_ids:
            - generativeAIForSecurity
          is_system_action_type: false
    get_connector_response:
      summary: Get connector details.
      value:
        id: df770e30-8b8b-11ed-a780-3b746c987a81
        name: my_server_log_connector
        config: { }
        connector_type_id: .server-log
        is_preconfigured: false
        is_deprecated: false
        is_missing_secrets: false
        is_system_action: false
    update_index_connector_request:
      summary: Update an index connector.
      value:
        name: updated-connector
        config:
          index: updated-index
    create_email_connector_request:
      summary: Create an email connector.
      value:
        name: email-connector-1
        connector_type_id: .email
        config:
          from: tester@example.com
          hasAuth: true
          host: https://example.com
          port: 1025
          secure: false
          service: other
        secrets:
          user: username
          password: password
    create_index_connector_request:
      summary: Create an index connector.
      value:
        name: my-connector
        connector_type_id: .index
        config:
          index: test-index
    create_webhook_connector_request:
      summary: Create a webhook connector with SSL authentication.
      value:
        name: my-webhook-connector
        connector_type_id: .webhook
        config:
          method: post
          url: https://example.com
          authType: webhook-authentication-ssl
          certType: ssl-crt-key
        secrets:
          crt: QmFnIEF0dH...
          key: LS0tLS1CRUdJ...
          password: my-passphrase
    create_xmatters_connector_request:
      summary: Create an xMatters connector with URL authentication.
      value:
        name: my-xmatters-connector
        connector_type_id: .xmatters
        config:
          usesBasic: false
        secrets:
          secretsUrl: https://example.com?apiKey=xxxxx
    create_email_connector_response:
      summary: A new email connector.
      value:
        id: 90a82c60-478f-11ee-a343-f98a117c727f
        connector_type_id: .email
        name: email-connector-1
        config:
          from: tester@example.com
          service: other
          host: https://example.com
          port: 1025
          secure: false
          hasAuth: true
          tenantId: 'null'
          clientId: 'null'
          oauthTokenUrl: 'null'
        is_preconfigured: false
        is_deprecated: false
        is_missing_secrets: false
        is_system_action: false
    create_index_connector_response:
      summary: A new index connector.
      value:
        id: c55b6eb0-6bad-11eb-9f3b-611eebc6c3ad
        connector_type_id: .index
        name: my-connector
        config:
          index: test-index
          refresh: false
          executionTimeField: 'null'
        is_preconfigured: false
        is_deprecated: false
        is_missing_secrets: false
        is_system_action: false
    create_webhook_connector_response:
      summary: A new webhook connector.
      value:
        id: 900eb010-3b9d-11ee-a642-8ffbb94e38bd
        name: my-webhook-connector
        config:
          method: post
          url: https://example.com
          authType: webhook-authentication-ssl
          certType: ssl-crt-key
          verificationMode: full
          headers: 'null'
          hasAuth: true
        connector_type_id: .webhook
        is_preconfigured: false
        is_deprecated: false
        is_missing_secrets: false
        is_system_action: false
    run_index_connector_request:
      summary: Run an index connector.
      value:
        params:
          documents:
            - id: my_doc_id
              name: my_doc_name
              message: 'hello, world'
    run_jira_connector_request:
      summary: Run a Jira connector to retrieve the list of issue types.
      value:
        params:
          subAction: issueTypes
    run_servicenow_itom_connector_request:
      summary: Run a ServiceNow ITOM connector to retrieve the list of choices.
      value:
        params:
          subAction: getChoices
          subActionParams:
            fields:
              - severity
              - urgency
    run_slack_api_connector_request:
      summary: Run a Slack connector that uses the web API method to post a message on a channel.
      value:
        params:
          subAction: postMessage
          subActionParams:
            channelIds:
              - C123ABC456
            text: A test message.
    run_swimlane_connector_request:
      summary: Run a Swimlane connector to create an incident.
      value:
        params:
          subAction: pushToService
          subActionParams:
            comments:
              - commentId: 1
                comment: A comment about the incident.
            incident:
              caseId: '1000'
              caseName: Case name
              description: Description of the incident.
    run_index_connector_response:
      summary: Response from running an index connector.
      value:
        connector_id: fd38c600-96a5-11ed-bb79-353b74189cba
        data:
          errors: false
          items:
            - create:
                _id: 4JtvwYUBrcyxt2NnfW3y
                _index: my-index
                _primary_term: 1
                _seq_no: 0
                _shards:
                  failed: 0
                  successful: 1
                  total: 2
                _version: 1
                result: created
                status: 201
          took: 135
        status: ok
    run_jira_connector_response:
      summary: Response from retrieving the list of issue types for a Jira connector.
      value:
        connector_id: b3aad810-edbe-11ec-82d1-11348ecbf4a6
        data:
          - id: 10024
            name: Improvement
          - id: 10006
            name: Task
          - id: 10007
            name: Sub-task
          - id: 10025
            name: New Feature
          - id: 10023
            name: Bug
          - id: 10000
            name: Epic
        status: ok
    run_server_log_connector_response:
      summary: Response from running a server log connector.
      value:
        connector_id: 7fc7b9a0-ecc9-11ec-8736-e7d63118c907
        status: ok
    run_servicenow_itom_connector_response:
      summary: Response from retrieving the list of choices for a ServiceNow ITOM connector.
      value:
        connector_id: 9d9be270-2fd2-11ed-b0e0-87533c532698
        data:
          - dependent_value: ''
            element: severity
            label: Critical
            value: 1
          - dependent_value: ''
            element: severity
            label: Major
            value: 2
          - dependent_value: ''
            element: severity
            label: Minor
            value: 3
          - dependent_value: ''
            element: severity
            label: Warning
            value: 4
          - dependent_value: ''
            element: severity
            label: OK
            value: 5
          - dependent_value: ''
            element: severity
            label: Clear
            value: 0
          - dependent_value: ''
            element: urgency
            label: 1 - High
            value: 1
          - dependent_value: ''
            element: urgency
            label: 2 - Medium
            value: 2
          - dependent_value: ''
            element: urgency
            label: 3 - Low
            value: 3
        status: ok
    run_slack_api_connector_response:
      summary: Response from posting a message with a Slack connector.
      value:
        status: ok
        data:
          ok: true
          channel: C123ABC456
          ts: '1234567890.123456'
          message:
            bot_id: B12BCDEFGHI
            type: message
            text: A test message
            user: U12A345BC6D
            ts: '1234567890.123456'
            app_id: A01BC2D34EF
            blocks:
              - type: rich_text
                block_id: /NXe
                elements:
                  - type: rich_text_section
                    elements:
                      - type: text
                        text: A test message.
            team: T01ABCDE2F
            bot_profile:
              id: B12BCDEFGHI
              app_id: A01BC2D34EF
              name: test
              icons:
                image_36: https://a.slack-edge.com/80588/img/plugins/app/bot_36.png
              deleted: false
              updated: 1672169705
              team_id: T01ABCDE2F
        connector_id: .slack_api
    run_swimlane_connector_response:
      summary: Response from creating a Swimlane incident.
      value:
        connector_id: a4746470-2f94-11ed-b0e0-87533c532698
        data:
          id: aKPmBHWzmdRQtx6Mx
          title: TEST-457
          url: https://elastic.swimlane.url.us/record/aNcL2xniGHGpa2AHb/aKPmBHWzmdRQtx6Mx
          pushedDate: '2022-09-08T16:52:27.866Z'
          comments:
            - commentId: 1
              pushedDate: '2022-09-08T16:52:27.865Z'
        status: ok
    get_connectors_response:
      summary: A list of connectors
      value:
        - id: preconfigured-email-connector
          name: my-preconfigured-email-notification
          connector_type_id: .email
          is_preconfigured: true
          is_deprecated: false
          referenced_by_count: 0
          is_system_action: false
        - id: e07d0c80-8b8b-11ed-a780-3b746c987a81
          name: my-index-connector
          config:
            index: test-index
            refresh: false
            executionTimeField: 'null'
          connector_type_id: .index
          is_preconfigured: false
          is_deprecated: false
          referenced_by_count: 2
          is_missing_secrets: false
          is_system_action: false
    get_roles_response1:
      summary: Get all role details
      value:
        - name: my_kibana_role
          description: My kibana role description
          metadata:
            version: 1
          transient_metadata:
            enabled: true
          elasticsearch:
            indices: [ ]
            cluster: [ ]
            run_as: [ ]
          kibana:
            - base:
                - all
              feature: { }
              spaces:
                - '*'
        - name: my_admin_role
          description: My admin role description
          metadata:
            version: 1
          transient_metadata:
            enabled: true
          elasticsearch:
            cluster:
              - all
            indices:
              - names:
                  - index1
                  - index2
                privileges:
                  - all
                field_security:
                  grant:
                    - title
                    - body
                query: '{\"match\": {\"title\": \"foo\"}}'
          kibana: [ ]
    get_role_response1:
      summary: Get role details
      value:
        name: my_kibana_role
        description: 'Grants all cluster privileges and full access to index1 and index2. Grants full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grants all Kibana privileges in the default space.'
        metadata:
          version: 1
        transient_metadata:
          enabled: true
        elasticsearch:
          cluster:
            - all
          remote_cluster:
            - privileges:
                - monitor_enrich
              clusters:
                - remote_cluster1
          indices:
            - names:
                - index1
                - index2
              privileges:
                - all
              allow_restricted_indices: false
          remote_indices:
            - names:
                - remote_index1
                - remote_index2
              privileges:
                - all
              allow_restricted_indices: false
              clusters:
                - remote_cluster1
          run_as: [ ]
        kibana:
          - base:
              - all
            feature: { }
            spaces:
              - default
        _transform_error: [ ]
        _unrecognized_applications: [ ]
    create_role_request1:
      summary: Feature privileges in multiple spaces
      description: Grant access to various features in some spaces.
      value:
        description: 'Grant full access to discover and dashboard features in the default space. Grant read access in the marketing, and sales spaces.'
        metadata:
          version: 1
        elasticsearch:
          cluster: [ ]
          indices: [ ]
        kibana:
          - base: [ ]
            feature:
              discover:
                - all
              dashboard:
                - all
            spaces:
              - default
          - base:
              - read
            spaces:
              - marketing
              - sales
    create_role_request2:
      summary: Dashboard privileges in a space
      description: Grant access to dashboard features in a Marketing space.
      value:
        description: Grant dashboard access in the Marketing space.
        metadata:
          version: 1
        elasticsearch:
          cluster: [ ]
          indices: [ ]
        kibana:
          - base: [ ]
            feature:
              dashboard:
                - read
            spaces:
              - marketing
    create_role_request3:
      summary: Feature privileges in a space
      description: Grant full access to all features in the default space.
      value:
        metadata:
          version: 1
        elasticsearch:
          cluster: [ ]
          indices: [ ]
        kibana:
          - base:
              - all
            feature: { }
            spaces:
              - default
    create_role_request4:
      summary: Elasticsearch and Kibana feature privileges
      description: Grant Elasticsearch and Kibana feature privileges.
      value:
        description: 'Grant all cluster privileges and full access to index1 and index2. Grant full access to remote_index1 and remote_index2, and the monitor_enrich cluster privilege on remote_cluster1. Grant all Kibana privileges in the default space.'
        metadata:
          version: 1
        elasticsearch:
          cluster:
            - all
          indices:
            - names:
                - index1
                - index2
              privileges:
                - all
          remote_indices:
            - clusters:
                - remote_cluster1
              names:
                - remote_index1
                - remote_index2
              privileges:
                - all
          remote_cluster:
            - clusters:
                - remote_cluster1
              privileges:
                - monitor_enrich
        kibana:
          - base:
              - all
            feature: { }
            spaces:
              - default
    copy_saved_objects_request1:
      summary: Copy with createNewCopies
      description: "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n"
      value:
        objects:
          - type: dashboard
            id: my-dashboard
        spaces:
          - marketing
        includeReferences: true
    copy_saved_objects_request2:
      summary: Copy without createNewCopies
      description: "Copy a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and that has a reference to a data view.\n"
      value:
        objects:
          - type: dashboard
            id: my-dashboard
        spaces:
          - marketing
        includeReferences: true
        createNewCopies: false
    copy_saved_objects_response1:
      summary: Copy with createNewCopies
      description: "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. The result indicates a successful copy and all three objects are created. Since these objects were created as new copies, each entry in the successResults array includes a destinationId attribute.\n"
      value:
        marketing:
          success: true
          successCount: 3
          successResults:
            - id: my-dashboard
              type: dashboard
              destinationId: 1e127098-5b80-417f-b0f1-c60c8395358f
              meta:
                icon: dashboardApp
                title: Look at my dashboard
            - id: my-vis
              type: visualization
              destinationId: a610ed80-1c73-4507-9e13-d3af736c8e04
              meta:
                icon: visualizeApp
                title: Look at my visualization
            - id: my-index-pattern
              type: index-pattern
              destinationId: bc3c9c70-bf6f-4bec-b4ce-f4189aa9e26b
              meta:
                icon: indexPatternApp
                title: my-pattern-*
    copy_saved_objects_response2:
      summary: Copy without createNewCopies
      description: "The response for successfully copying a dashboard with the my-dashboard ID with createNewCopies turned off. The result indicates a successful copy and all three objects are created.\n"
      value:
        marketing:
          success: true
          successCount: 3
          successResults:
            - id: my-dashboard
              type: dashboard
              meta:
                icon: dashboardApp
                title: Look at my dashboard
            - id: my-vis
              type: visualization
              meta:
                icon: visualizeApp
                title: Look at my visualization
            - id: my-index-pattern
              type: index-pattern
              meta:
                icon: indexPatternApp
                title: my-pattern-*
    copy_saved_objects_response3:
      summary: Failed copy response with conflict errors
      description: "A response for a failed copy of a dashboard with the my-dashboard ID including all references from the default space to the marketing and sales spaces. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to an index pattern. The result indicates a successful copy for the marketing space and an unsuccessful copy for the sales space because the data view, visualization, and Canvas workpad each resulted in a conflict error. Objects are created when the error is resolved using the resolve copy conflicts API.\n"
      value:
        marketing:
          success: true
          successCount: 4
          successResults:
            - id: my-dashboard
              type: dashboard
              meta:
                icon: dashboardApp
                title: Look at my dashboard
            - id: my-vis
              type: visualization
              meta:
                icon: visualizeApp
                title: Look at my visualization
            - id: my-canvas
              type: canvas-workpad
              meta:
                icon: canvasApp
                title: Look at my canvas
            - id: my-index-pattern
              type: index-pattern
              meta:
                icon: indexPatternApp
                title: my-pattern-*
        sales:
          success: false
          successCount: '1,'
          errors:
            - id: my-pattern
              type: index-pattern
              title: my-pattern-*
              error:
                type: conflict
              meta:
                icon: indexPatternApp
                title: my-pattern-*
            - id: my-visualization
              type: my-vis
              title: Look at my visualization
              error:
                type: conflict
                destinationId: another-vis
              meta:
                icon: visualizeApp
                title: Look at my visualization
            - id: my-canvas
              type: canvas-workpad
              title: Look at my canvas
              error:
                type: ambiguous_conflict
                destinations:
                  - id: another-canvas
                    title: Look at another canvas
                    updatedAt: '2020-07-08T16:36:32.377Z'
                  - id: yet-another-canvas
                    title: Look at yet another canvas
                    updatedAt: '2020-07-05T12:29:54.849Z'
              meta:
                icon: canvasApp
                title: Look at my canvas
          successResults":
            - id: my-dashboard
              type: dashboard
              meta:
                icon: dashboardApp
                title: Look at my dashboard
    copy_saved_objects_response4:
      summary: Failed copy with missing reference errors
      description: "The response for successfully copying a dashboard with the my-dashboard ID, including all references from the default space to the marketing space. In this example, the dashboard has a reference to a visualization and a Canvas workpad and the visualization has a reference to a data view. The result indicates an unsuccessful copy because the visualization resulted in a missing references error. Objects are created when the errors are resolved using the resolve copy conflicts API.\n"
      value:
        marketing:
          success: false
          successCount: 2
          errors:
            - id: my-vis
              type: visualization
              title: Look at my visualization
              error:
                type: missing_references
                references:
                  - type: index-pattern
                    id: my-pattern-*
              meta:
                icon: visualizeApp
                title: Look at my visualization
          successResults:
            - id: my-dashboard
              type: dashboard
              meta:
                icon: dashboardApp
                title: Look at my dashboard
            - id: my-canvas
              type: canvas-workpad
              meta:
                icon: canvasApp
                title: Look at my canvas
    disable_legacy_url_request1:
      summary: Disable legacy URL aliases
      description: "This request leaves the alias intact but the legacy URL for this alias (http://localhost:5601/s/bills-space/app/dashboards#/view/123) will no longer function. The dashboard still exists and you can access it with the new URL.\n"
      value:
        aliases:
          - targetSpace: bills-space
            targetType: dashboard
            sourceId: 123
    get_shareable_references_request1:
      summary: Get shareable references
      description: "Collect references and space contexts for a dashboard saved object.\n"
      value:
        objects:
          - type: dashboard
            id: my-dashboard-id
    get_shareable_references_response1:
      summary: Get shareable references response
      description: "A response that includes the collected references and the spaces where the objects exist.\n"
      value:
        objects:
          - type: dashboard
            id: my-dashboard-id
            spaces:
              - default
              - marketing
            inboundReferences: [ ]
    resolve_copy_saved_objects_request1:
      summary: Resolve conflict errors
      description: "Resolve conflict errors for a data view, visualization, and Canvas workpad by overwriting the existing saved objects. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard accordingly.\n"
      value:
        objects:
          - type: dashboard
            id: my-dashboard
        includeReferences: true
        createNewCopies: false
        retries:
          sales:
            - type: index-pattern
              id: my-pattern
              overwrite: true
            - type: visualization
              id: my-vis
              overwrite: 'true,'
              destinationId: another-vis
            - type: canvas
              id: my-canvas
              overwrite: true
              destinationId: yet-another-canvas
            - type: dashboard
              id: my-dashboard
    resolve_copy_saved_objects_request2:
      summary: Resolve missing reference errors
      description: "Resolve missing reference errors for a visualization by ignoring the error. NOTE: If a prior copy attempt resulted in resolvable errors, you must include a retry for each object you want to copy, including any that were returned in the successResults array. In this example, we retried copying the dashboard and canvas accordingly.\n"
      value:
        objects:
          - type: dashboard
            id: my-dashboard
        includeReferences: true
        createNewCopies: false
        retries:
          marketing:
            - type: visualization
              id: my-vis
              ignoreMissingReferences: true
            - type: canvas
              id: my-canvas
            - type: dashboard
              id: my-dashboard
    update_saved_objects_spaces_request1:
      summary: Update saved object spaces
      description: Update the spaces of each saved object and all its references.
      value:
        objects:
          - type: index-pattern
            id: 90943e30-9a47-11e8-b64d-95841ca0b247
        spacesToAdd:
          - test
        spacesToRemove: [ ]
    update_saved_objects_spaces_response1:
      summary: Update saved object spaces
      description: "The response from updating the spaces of saved objects.\n"
      value:
        objects:
          - type: index-pattern
            id: 90943e30-9a47-11e8-b64d-95841ca0b247
            spaces:
              - default
              - test
    get_spaces_response1:
      summary: Get all spaces
      description: Get all spaces without specifying any options.
      value:
        - id: default
          name: Default
          description: This is the Default Space
          disabledFeatures: [ ]
          imageUrl: ''
          _reserved: true
        - id: marketing
          name: Marketing
          description: This is the Marketing Space
          color: 'null'
          disabledFeatures:
            - apm
          initials: MK
          imageUrl: 'data:image/png;base64,iVBORw0KGgoAAAANSU'
        - id: sales
          name: Sales
          initials: MK
          disabledFeatures:
            - discover
          imageUr": ''
          solution: oblt
    get_spaces_response2:
      summary: Get all spaces with custom options
      description: "The user has read-only access to the Sales space. Get all spaces with the following query parameters: \"purpose=shareSavedObjectsIntoSpace&include_authorized_purposes=true\"\n"
      value:
        - id: default
          name: Default
          description: This is the Default Space
          disabledFeatures: [ ]
          imageUrl: ''
          _reserved: true
          authorizedPurposes:
            any: true
            copySavedObjectsIntoSpace: true
            findSavedObjects: true
            shareSavedObjectsIntoSpace: true
        - id: marketing
          name: Marketing
          description: This is the Marketing Space
          color: 'null'
          disabledFeatures:
            - apm
          initials: MK
          imageUrl: 'data:image/png;base64,iVBORw0KGgoAAAANSU'
          authorizedPurposes:
            any: true
            copySavedObjectsIntoSpace: true
            findSavedObjects: true
            shareSavedObjectsIntoSpace: true
        - id: sales
          name: Sales
          initials: MK
          disabledFeatures:
            - discover
          imageUrl: ''
          authorizedPurposes:
            any: true
            copySavedObjectsIntoSpace: false
            findSavedObjects: true
            shareSavedObjectsIntoSpace: false
    create_space_request:
      summary: Create a marketing space
      value:
        id: marketing
        name: Marketing
        description: This is the Marketing Space
        color: 'null'
        initials: MK
        disabledFeatures: [ ]
        imageUrl: 'data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAD4AAABACAYAAABC6cT1AAAGf0lEQVRoQ+3abYydRRUH8N882xYo0IqagEVjokQJKAiKBjXExC9G/aCkGowCIghCkRcrVSSKIu/FEiqgGL6gBIlAYrAqUTH6hZgQFVEMKlQFfItWoQWhZe8z5uzMLdvbfbkLxb13d+fbvfe588x/zpn/+Z9zJpmnI81T3BaAzzfLL1h8weLzZAcWXH2eGHo7zAWLL1h8nuzAjFw9G1N6Kzq8HnuM36MR8iibF3Fv4q+7cv8yDV6K13bYq2furSP8Ag8ncr/vnSnwRViJT2GfCV7yL1yHGxLb+l3EdM9lluNEnIC9xz+f2ZL4Er6Z2DrdXN3fZwp8CU7OfDHxggle8lTLbQ1nJ/7Z7yKmey5zYGZt4h2IzR8/trRc2PDlxJPTzfVcgJ+CC0wMPOa9F6cm7up3EVM9V9386MxliVdM8GwAv6hh/awCz/w7lY25OtF5ruBz4ZLP42NYNrDAFbC3YPWuILnMAfgq3oaRQQYea/stViV+sgssvjKzLvGySeaaNVfP4d7Btokgvxj/bblgpueuF1hmWcyTCmfE3J3M1lTcv0vMswM88zR+jpw4osu6me8kzkpsfLZWzxyRuabO22buxxOJ12FxnXfWgEe83pB5sOE47BsLymzscOoi7nw2JJfZreUjiUsTyzKPZm5NvBDvSuw268AzNzV8H5/Am+qCnsAXgpgSW2Zq9cyKlksbPlTd+te4quWNieMHBfiNDdciYnwsdI/MaOaWhnMTf54J8CqNj8x8JXFIZltYu+HqlmNT8YSBsHgAPw/vxvlVV4du/s0oaxbxg0TbL/jMni0nNcVjQq7+HZfgtpbzBg342TgQ63AkmsymxBW4IjE6A+D7Vzd/fyWxIM/VuCe+HzTgZ2Jpy/kNJ2FJLmLm24mPJ/42A+Bvrxt4SISwlhsaPodH26LZB8rVA3inwwebsrixJCZzX+KMxI/7AV61eVh3DV6Mx3EOvh4kN6jAg8nfUCXm4d1wE66OyxNPTQc+s3/o/MoXizL3JE5O3F3P/uBZPPF4Zr+Wi5uSO48ZPRdyCwn7YB/A35m5KhWNHox4fcNnIs0ddOCRSBxf8+cQG+Huf0l8NJVYP+nI7NXy2ar4QqIGm69JfKPOE2w/mBavCzwM11R2D+ChsUO7hyUfmwx55qDM1xJvqZ7y08TpifuGBfjeURVJnNIVGpkNiXNS0ds7jcySDitDCCWW56LJ10fRo8sNA+3qXUSZD2CtQlZh9T+1rB7h9oliembflnMbzqgSNZKbKGHdPm7OwXb1CvQ1metSETMpszmzvikCJNh/h5E5PHNl4qga/+/cxqrdeWDYgIe7X5L4cGJPJX2940lOX8pD41FnFnc4riluvQKbK0dcHJFi2IBHNTQSlguru4d2/wPOTNzRA3x5y+U1E1uqWDkETOT026XuUJzx6u7ReLhSYenQ7uHua0fKZmwfmcPqsQjxE5WVONcRxn7X89zgn/EKPMRMxOVQXmP18Mx3q3b/Y/0cQE/IhFtHESMsHFlZ1Ml3CH3DZPHImY+pxcKumNmYirtvqMBfhMuU6s3iqOQkTsMPe1tCQwO8Ajs0lxr7W+vnp1MJc9EgCNd/cy6x+9D4veXmprj5wxMw/3C4egW6zzgZOlYZzfwo3F2J7ael0pJamvlPKgWNKFft1AAcKotXoFEbD7kaoSoQPVKB35+5KHF0lai/rJo+up87jWEE/qqqwY+qrL21LWLm95lPJ16ppKw31XC3PXYPJauPEx7B6BHCgrSizRs18qiaRp8tlN3ueCTYPHH9RNaunjI8Z7wLYpT3jZSCYXQ8e9vTsRE/q+no3XMKeObgGtaintbb/AvXj4JDkNw/5hrwYPfIvlZFUbLn7G5q+eQIN09Vnho6cqvnM/Lt99RixH49wO8K0ZL41WTWHoQzvsNVkOheZqKhEGpsp3SzB+BBtZAYve7uOR9tuTaaB6l0XScdYfEQPpkTUyHEGP+XqyDBzu+NBCITUjNWHynkrbWKOuWFn1xKzqsyx0bdvS78odp0+N503Zao0uCsWuSIDku8/7EO60b41vN5+Ses9BKlTdvd8bhp9EBvJjWJAIn/vxwHe6b3tSk6JFPV4nq85oAOrx555v/x/rh3E6Lo+bnuNS4uB4Cuq0ZfvO8X1rM6q/+vnjLVqZq7v83onttc2oYF4HPJmv1gWbB4P7s0l55ZsPhcsmY/WBYs3s8uzaVn5q3F/wf70mRuBCtbjQAAAABJRU5ErkJggg=='
    get_space_response:
      summary: Get details about a marketing space
      value:
        id: marketing
        name: Marketing
        description: This is the Marketing Space
        color: 'null'
        initials: MK
        disabledFeatures: [ ]
        imageUrl: ''
        solution: es
    update_space_request:
      summary: Update a marketing space
      description: Update the marketing space to remove the imageUrl.
      value:
        id: marketing
        name: Marketing
        description: This is the Marketing Space
        color: 'null'
        initials: MK
        disabledFeatures: [ ]
        imageUrl: ''
  securitySchemes:
    apiKeyAuth:
      type: apiKey
      description: "These APIs use key-based authentication. You must create an API key and use the encoded value in the request header. For example: `Authorization: ApiKey base64AccessApiKey`\n"
      name: Authorization
      in: header
    basicAuth:
      type: http
      scheme: basic
security:
  - apiKeyAuth: [ ]
  - basicAuth: [ ]
tags:
  - name: agent builder
    description: "Agent Builder is a set of AI-powered capabilities for developing and interacting with agents that work with your Elasticsearch data.\n\nMost users will probably want to integrate with Agent Builder using MCP or A2A, but you can also work programmatically with tools, agents, and conversations using these Kibana APIs. Follow the [Agent Builder API tutorial](https://www.elastic.co/docs/explore-analyze/ai-features/agent-builder/agent-builder-api-tutorial) for a guided example.\n\n**Elastic Agent Builder requires an Enterprise subscription.**\n"
    externalDocs:
      description: Agent Builder docs
      url: https://www.elastic.co/docs/solutions/search/agent-builder/programmatic-access
    x-displayName: Agent Builder
  - name: alerting
    description: "Alerting enables you to define rules, which detect complex conditions within your data. When a condition is met, the rule tracks it as an alert and runs the actions that are defined in the rule. Actions typically involve the use of connectors to interact with Kibana services or third party integrations.\n"
    externalDocs:
      description: Alerting documentation
      url: https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts
    x-displayName: Alerting
  - name: alerting-v2
    description: "Alerting V2 is an ES|QL-first alerting API for managing rules, alert actions, and action policies. Use these endpoints to create and manage detection rules, act on alerts, and control when and how notifications are delivered. These APIs are experimental.\n"
    x-displayName: Alerting V2
  - name: APM agent configuration
    description: "Adjust APM agent configuration without need to redeploy your application.\n"
  - name: APM agent keys
    description: "Configure APM agent keys to authorize requests from APM agents to the APM Server.\n"
  - name: APM annotations
    description: "Annotate visualizations in the APM app with significant events. Annotations enable you to easily see how events are impacting the performance of your applications.\n"
  - name: APM server schema
    description: Create APM fleet server schema.
  - name: APM sourcemaps
    description: "Configure APM source maps. A source map allows minified files to be mapped back to original source code--allowing you to maintain the speed advantage of minified code, without losing the ability to quickly and easily debug your application.\nFor best results, uploading source maps should become a part of your deployment procedure, and not something you only do when you see unhelpful errors. That's because uploading source maps after errors happen won't make old errors magically readable--errors must occur again for source mapping to occur.\n"
  - name: cases
    description: "Cases are used to open and track issues. You can add assignees and tags to your cases, set their severity and status, and add alerts, comments, and visualizations. You can also send cases to external incident management systems by configuring connectors.\n"
    externalDocs:
      description: Cases documentation
      url: https://www.elastic.co/docs/explore-analyze/alerts-cases/cases
    x-displayName: Cases
  - name: connectors
    description: "Connectors provide a central place to store connection information for services and integrations with Elastic or third party systems. Alerting rules can use connectors to run actions when rule conditions are met.\n"
    externalDocs:
      description: Connector documentation
      url: https://www.elastic.co/docs/reference/kibana/connectors-kibana
    x-displayName: Connectors
  - name: Dashboards
    description: "A [dashboard](https://www.elastic.co/docs/explore-analyze/dashboards) is a collection of panels arranged on a grid. Each panel can contain a visualization, a Discover session, an image, markdown text, or an interactive filter control. Use this API to create and manage dashboards programmatically.\n\n## When to use this API\n\n- Use this API to define a complete, self-contained dashboard in a single payload, including inline visualizations (both data view and ES|QL based), controls, and filters.\n- Use the [Visualizations API](visualizations#tag/Visualizations/operation/create-visualization) to create reusable charts saved to your [visualization library](https://www.elastic.co/docs/explore-analyze/visualize/visualize-library). You can then embed them in dashboards as linked panels using their ID.\n\n## Get started\n\nBefore you begin:\n\n- **Authentication**: Refer to [Authentication](https://www.elastic.co/docs/api/doc/kibana#authentication) in the Kibana API documentation.\n- **CSRF protection**: Write operations (`POST`, `PUT`, `DELETE`) require the `kbn-xsrf: true` header.\n- **Spaces**: If you use non-default [Kibana spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces), prepend `s/{space_id}/` to the path.\n\n### Try it now\n\nCreate your first dashboard right now. The following example creates a dashboard with an ES|QL line chart showing log entries over time. You can run it as-is once you have the [Kibana sample logs dataset](https://www.elastic.co/docs/manage-data/ingest/sample-data) installed:\n\n```bash\ncurl -X POST \"${KIBANA_URL}/api/dashboards\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"title\": \"My first API dashboard\",\n    \"panels\": [\n      {\n        \"grid\": {\n          \"x\": 0,\n          \"y\": 0,\n          \"w\": 24,\n          \"h\": 10\n        },\n        \"type\": \"vis\",\n        \"config\": {\n          \"type\": \"xy\",\n          \"title\": \"Total log entries over time\",\n          \"layers\": [\n            {\n              \"type\": \"line\",\n              \"data_source\": {\n                \"type\": \"esql\",\n                \"query\": \"FROM kibana_sample_data_logs | STATS count = COUNT() BY BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n              },\n              \"x\": {\n                \"column\": \"BUCKET(@timestamp, 75, ?_tstart, ?_tend)\"\n              },\n              \"y\": [\n                {\n                  \"column\": \"count\"\n                }\n              ]\n            }\n          ],\n          \"axis\": {\n            \"x\": {\n              \"title\": {\n                \"visible\": false\n              }\n            }\n          }\n        }\n      }\n    ]\n  }'\n```\n\nAll examples on this page use [Kibana sample datasets](https://www.elastic.co/docs/manage-data/ingest/sample-data) (`kibana_sample_data_logs`, `kibana_sample_data_ecommerce`, `kibana_sample_data_flights`). To use your own data, replace the `FROM` pattern and field references.\n\n### Dashboard structure\n\nA [dashboard](https://www.elastic.co/docs/explore-analyze/dashboards) is structured as follows:\n\n- **`title`** (required): the display name of the dashboard.\n- **`panels`**: array of items placed on a 48-column grid. Each item has a `type`, a `grid` position (`x`, `y`, `w`, `h`), and a `config`. Two item shapes are supported:\n  - **Panel**: any content type, including visualizations, Discover sessions, images, markdown, and filter controls. The `type` field determines the panel's content and the structure of its `config`.\n  - **Section**: a collapsible group of panels. Use sections to organize a large dashboard into logical groups. A section has a `grid.y` position and its own nested `panels` array.\n\n  The grid is 48 columns wide. Use `w: 48` for a full-width panel, `w: 24` for half-width, and so on. Height (`h`) and vertical position (`y`) are in grid rows with no fixed maximum.\n- **`pinned_panels`**: filter controls pinned at the top of the dashboard that apply to all panels. Filter controls placed in `panels` apply only to panels in the same section.\n- **`filters`**, **`query`**, **`time_range`**: filter the data displayed across all panels.\n\n### Panel types\n\nThe `type` field in each panel determines what it contains and the structure of its `config`:\n\n| Type | Description |\n|------|-------------|\n| `vis` | Visualization (bar, line, metric, and so on), supports both data view and ES&#124;QL queries |\n| `discover_session` | Discover session |\n| `image` | Image |\n| `markdown` | Markdown text |\n| `links` | Navigation links to dashboards and external URLs |\n| `esql_control` | ES&#124;QL variable control |\n| `options_list_control` | Dropdown filter by field value |\n| `range_slider_control` | Slider filter by numeric range |\n| `time_slider_control` | Time range slider |\n\nAdditional panel types for observability use cases:\n\n| Type | Description |\n|------|-------------|\n| `slo_alerts` | SLO alerts |\n| `slo_burn_rate` | SLO burn rate |\n| `slo_error_budget` | SLO error budget |\n| `slo_overview` | SLO overview |\n| `synthetics_monitors` | Synthetics monitors |\n| `synthetics_stats_overview` | Synthetics stats overview |\n| `apm_service_map` | APM service map |\n\nAdditional panel types for machine learning use cases:\n\n| Type | Description |\n|------|-------------|\n| `ml_single_metric_viewer` | Single metric viewer |\n| `ml_anomaly_swimlane` | Anomaly swim lane |\n| `ml_anomaly_charts` | Anomaly charts |\n| `aiops_change_point_chart` | Change point detection chart |\n| `aiops_log_rate_analysis` | Log rate analysis |\n| `aiops_pattern_analysis` | Pattern analysis |\n| `field_stats_table` | Field statistics table |\n\n> info\n> The following panel types are supported in the Kibana UI but not yet by the REST API: `map`, `legacy_vis`, `alerts_table`. Write operations (`POST`, `PUT`) return a `400` error when these panel types are included. Read operations (`GET`) strip these panels from the response and include them in a list of warnings.\n\n### Embedding library items\n\n`vis`, `discover_session`, `markdown`, and `links` panels can be embedded **inline** (full config stored in the dashboard) or **linked from library** (references a library item by ID).\n\nFor the full `config` schema for visualization panels, including chart types, metric operations, and breakdowns, refer to the [Visualizations API](visualizations#tag/Visualizations/operation/create-visualization).\n\n- **Inline**: use when the panel is specific to this dashboard or must work across Kibana spaces. The panel configuration goes directly inside `config`:\n\n  ```json\n  {\n    \"grid\": {\n      \"x\": 0,\n      \"y\": 0,\n      \"w\": 12,\n      \"h\": 8\n    },\n    \"type\": \"vis\",\n    \"config\": {\n      \"type\": \"metric\",\n      \"title\": \"Average bytes\",\n      \"data_source\": {\n        \"type\": \"data_view_spec\",\n        \"index_pattern\": \"kibana_sample_data_logs\",\n        \"time_field\": \"timestamp\"\n      },\n      \"metrics\": [\n        {\n          \"type\": \"primary\",\n          \"operation\": \"average\",\n          \"field\": \"bytes\"\n        }\n      ]\n    }\n  }\n  ```\n\n- **Linked from library**: references an item in your library by its ID. Use `ref_id` with any supported panel type (`vis`, `discover_session`, `markdown`, `links`). Use the [Visualizations API](visualizations#tag/Visualizations/operation/create-visualization) to create and retrieve IDs for visualization items.\n\n  ```json\n  {\n    \"grid\": {\n      \"x\": 0,\n      \"y\": 0,\n      \"w\": 12,\n      \"h\": 8\n    },\n    \"type\": \"vis\",\n    \"config\": {\n      \"ref_id\": \"1e4f0a30-b3c5-11ef-bd7a-2b6b1a8c0f3d\"\n    }\n  }\n  ```\n\n### ES|QL visualizations\n\nTo create ES|QL-based charts, embed them inline as `vis` panels and set `data_source.type` to `\"esql\"`.\n\n- **`metric` charts**: reference query result columns in `metrics` using `column`:\n\n  ```json\n  {\n    \"grid\": {\n      \"x\": 0,\n      \"y\": 0,\n      \"w\": 12,\n      \"h\": 6\n    },\n    \"type\": \"vis\",\n    \"config\": {\n      \"type\": \"metric\",\n      \"title\": \"Total requests\",\n      \"data_source\": {\n        \"type\": \"esql\",\n        \"query\": \"FROM logs-* | STATS count = COUNT()\"\n      },\n      \"metrics\": [\n        {\n          \"type\": \"primary\",\n          \"column\": \"count\"\n        }\n      ]\n    }\n  }\n  ```\n\n- **`xy` charts**: `data_source` goes inside each layer. Use `BUCKET(@timestamp, 75, ?_tstart, ?_tend)` to align time-series buckets with the dashboard's selected time range. For a complete xy chart example, see the [Create a dashboard](#operation/create-dashboard) endpoint.\n"
    externalDocs:
      description: Dashboards documentation
      url: https://www.elastic.co/docs/explore-analyze/dashboards
    x-displayName: Dashboards
  - name: Data streams
    description: "Data stream APIs enable you to manage data streams, which are collections of indices that share the same index template and are managed as a single unit for time-series data.\n"
    x-displayName: Data streams
  - name: data views
    description: 'Data view APIs enable you to manage data views, formerly known as Kibana index patterns.'
    x-displayName: Data views
  - name: Elastic Agent actions
    description: "Elastic Agent actions APIs enable you to manage actions performed on Elastic Agents, including agent reassignment, diagnostics collection, enrollment management, upgrades, and bulk operations for agent lifecycle management.\n"
    x-displayName: Elastic Agent actions
  - name: Elastic Agent binary download sources
    description: "Elastic Agent binary download sources APIs enable you to manage download sources for Elastic Agent binaries, including creating, updating, and deleting custom download sources for agent binaries.\n"
    x-displayName: Elastic Agent binary download sources
  - name: Elastic Agent policies
    description: "Elastic Agent policies APIs enable you to manage agent policies, including creating, updating, and deleting policies, as well as to retrieve agent policy outputs, manifests, and auto-upgrade status information.\n"
    x-displayName: Elastic Agent policies
  - name: Elastic Agent status
    description: "Enables you to retrieve status information about Elastic Agents, including health summaries and operational status.\n"
    x-displayName: Elastic Agent status
  - name: Elastic Agents
    description: "Elastic Agents APIs enable you to manage Elastic Agents, including retrieving agent information, managing agent lifecycle, handling file uploads, and initiating agent setup.\n"
    x-displayName: Elastic Agents
  - name: Elastic Package Manager (EPM)
    description: "Elastic Package Manager (EPM) APIs enable you to manage packages and integrations, including installing, updating, and uninstalling packages, managing custom integrations, and handling package assets.\n"
    x-displayName: Elastic Package Manager (EPM)
  - name: Fleet agentless policies
  - name: Fleet cloud connectors
    description: "Fleet cloud connectors APIs enable you to manage Fleet cloud connectors, including creating, updating, and deleting cloud connector configurations for Fleet integrations.\n"
    x-displayName: Fleet cloud connectors
  - name: Fleet cloud onboarding deployments
  - name: Fleet enrollment API keys
    description: "Fleet enrollment API keys APIs enable you to manage enrollment API keys for Fleet, including creating, retrieving, and revoking API keys used for agent enrollment.\n"
    x-displayName: Fleet enrollment API keys
  - name: Fleet internals
    description: "Fleet internals APIs enable you to manage Fleet internal operations, including checking permissions, monitoring Fleet Server health, managing settings, and initiating Fleet setup.\n"
    x-displayName: Fleet internals
  - name: Fleet managed integrations
  - name: Fleet outputs
    description: "Fleet outputs APIs enable you to manage Fleet outputs, including creating, updating, and deleting output configurations, generating Logstash API keys, and monitoring output health.\n"
    x-displayName: Fleet outputs
  - name: Fleet package policies
    description: "Fleet package policies APIs enable you to manage Fleet package policies, including creating, updating, and deleting policies, performing bulk operations, and managing policy upgrades.\n"
    x-displayName: Fleet package policies
  - name: Fleet proxies
    description: "Fleet proxies APIs enable you to manage Fleet proxies, including creating, updating, and deleting proxy configurations for Fleet agent communication.\n"
    x-displayName: Fleet proxies
  - name: Fleet remote synced integrations
    description: "Use the Fleet remote synced integrations API to check the status of the automatic integrations synchronization on a remote cluster:\n* Use the `/api/fleet/remote_synced_integrations/{outputId}/remote_status` endpoint on the management cluster to query the synchronization status of the integrations installed on the remote cluster by the ID of the configured remote Elasticsearch output.\n* Use the `/api/fleet/remote_synced_integrations/status` endpoint on the remote cluster to query the synchronization status of the installed integrations.\n"
    externalDocs:
      description: Automatic integrations synchronization documentation
      url: https://www.elastic.co/docs/reference/fleet/automatic-integrations-synchronization
  - name: Fleet Server hosts
    description: "Fleet Server hosts APIs enable you to manage Fleet Server hosts, including creating, updating, and deleting Fleet Server host configurations.\n"
    x-displayName: Fleet Server hosts
  - name: Fleet service tokens
    description: "Enables you to create tokens for Fleet service authentication and authorization.\n"
    x-displayName: Fleet service tokens
  - name: Fleet uninstall tokens
    description: "Fleet uninstall tokens APIs enable you to manage Fleet uninstall tokens, including retrieving metadata and decrypted tokens for agent uninstallation.\n"
    x-displayName: Fleet uninstall tokens
  - name: Links
  - name: logstash
    description: "Programmatically integrate with Logstash configuration management.\n> warn\n> Do not directly access the `.logstash` index. The structure of the `.logstash` index is subject to change, which could cause your integration to break. Instead, use the Logstash configuration management APIs.\n"
    externalDocs:
      description: Centralized pipeline management
      url: https://www.elastic.co/docs/reference/logstash/logstash-centralized-pipeline-management
    x-displayName: Logstash configuration management
  - name: maintenance-window
    description: "You can schedule single or recurring maintenance windows to temporarily reduce rule notifications. For example, a maintenance window prevents false alarms during planned outages.\n"
    externalDocs:
      description: Maintenance window documentation
      url: https://www.elastic.co/docs/explore-analyze/alerts-cases/alerts/maintenance-windows
    x-displayName: Maintenance windows
  - name: Markdowns
  - name: Message Signing Service
    description: "Enables you to rotate message signing key pairs for secure Fleet communication.\n"
    x-displayName: Fleet Message Signing Service
  - name: ml
    description: "Enables you to synchronize machine learning saved objects.\n"
    x-displayName: Machine learning
  - name: observability_ai_assistant
    description: Interact with the Observability AI Assistant resources.
    externalDocs:
      description: Observability AI Assistant
      url: https://www.elastic.co/docs/solutions/observability/observability-ai-assistant
    x-displayName: Observability AI Assistant
  - name: roles
    description: Manage the roles that grant Elasticsearch and Kibana privileges.
    externalDocs:
      description: Kibana role management
      url: https://www.elastic.co/docs/deploy-manage/users-roles/cluster-or-deployment-auth/defining-roles
    x-displayName: Roles
  - name: saved objects
    description: "Export sets of saved objects that you want to import into Kibana, resolve import errors, and rotate an encryption key for encrypted saved objects with the saved objects APIs.\n\nTo manage a specific type of saved object, use the corresponding APIs.\nFor example, use:\n\n* [Data views](../group/endpoint-data-views)\n* [Spaces](../group/endpoint-spaces)\n* [Short URLs](../group/endpoint-short-url)\n\nWarning: Do not write documents directly to the `.kibana` index. When you write directly to the `.kibana` index, the data becomes corrupted and permanently breaks future Kibana versions.\n"
    x-displayName: Saved objects
  - name: Security AI Assistant API
    description: Manage and interact with Security Assistant resources.
    x-displayName: Security AI assistant
  - name: Security Attack discovery API
    description: 'Use the Attack discovery APIs to generate and manage Attack discoveries. Attack Discovery leverages large language models (LLMs) to analyze alerts in your environment and identify threats. Each "discovery" represents a potential attack and describes relationships among multiple alerts to tell you which users and hosts are involved, how alerts correspond to the MITRE ATT&CK matrix, and which threat actor might be responsible.'
    x-displayName: Security Attack discovery
  - name: Security Detections API
    description: "Use the detections APIs to create and manage detection rules. Detection rules search events and external alerts sent to Elastic Security and generate detection alerts from any hits. Alerts are displayed on the **Alerts** page and can be assigned and triaged, using the alert status to mark them as open, closed, or acknowledged.\n\nThis API supports both key-based authentication and basic authentication.\n\nTo use key-based authentication, create an API key, then specify the key in the header of your API calls.\n\nTo use basic authentication, provide a username and password; this automatically creates an API key that matches the current user’s privileges.\n\nIn both cases, the API key is subsequently used for authorization when the rule runs.\n> warn\n> If the API key used for authorization has different privileges than the key that created or most recently updated a rule, the rule behavior might change.\n\n> If the API key that created a rule is deleted, or the user that created the rule becomes inactive, the rule will stop running.\n\nTo create and run rules, the user must meet specific requirements for the Kibana space. Refer to the [Detections requirements](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html) for a complete list of requirements.\n"
    x-displayName: Security detections
  - name: Security Endpoint Exceptions API
    description: Endpoint Exceptions API allows you to manage detection rule endpoint exceptions to prevent a rule from generating an alert from incoming events even when the rule's other criteria are met.
    x-displayName: Security Elastic Endpoint exceptions
  - name: Security Endpoint Management API
    description: Interact with and manage endpoints running the Elastic Defend integration.
    x-displayName: Security endpoint management
  - name: Security Entity Analytics API
    description: "Use the Security entity analytics APIs to manage entity analytics and risk scoring, including asset criticality, privileged user monitoring, and entity engines.\n"
    x-displayName: Security entity analytics
  - name: Security entity store
  - name: Security Exceptions API
    description: "Exceptions are associated with detection and endpoint rules, and are used to prevent a rule from generating an alert from incoming events, even when the rule's other criteria are met. They can help reduce the number of false positives and prevent trusted processes and network activity from generating unnecessary alerts.\n\nExceptions are made up of:\n\n* **Exception containers**: A container for related exceptions. Generally, a single exception container contains all the exception items relevant for a subset of rules. For example, a container can be used to group together network-related exceptions that are relevant for a large number of network rules. The container can then be associated with all the relevant rules.\n* **Exception items**: The query (fields, values, and logic) used to prevent rules from generating alerts. When an exception item's query evaluates to `true`, the rule does not generate an alert.\n\nFor detection rules, you can also use lists to define rule exceptions. A list holds multiple values of the same Elasticsearch data type, such as IP addresses. These values are used to determine when an exception prevents an alert from being generated.\n> info\n> You cannot use lists with endpoint rule exceptions.\n\n> info\n> Only exception containers can be associated with rules. You cannot directly associate an exception item or a list container with a rule. To use list exceptions, create an exception item that references the relevant list container.\n\n## Exceptions requirements\n\nBefore you can start working with exceptions that use value lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. For a complete list of requirements, refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui).\n"
    x-displayName: Security exceptions
  - name: Security Lists API
    description: "Lists can be used with detection rule exceptions to define values that prevent a rule from generating alerts.\n\nLists are made up of:\n\n* **List containers**: A container for values of the same Elasticsearch data type. The following data types can be used:\n    * `boolean`\n    * `byte`\n    * `date`\n    * `date_nanos`\n    * `date_range`\n    * `double`\n    * `double_range`\n    * `float`\n    * `float_range`\n    * `half_float`\n    * `integer`\n    * `integer_range`\n    * `ip`\n    * `ip_range`\n    * `keyword`\n    * `long`\n    * `long_range`\n    * `short`\n    * `text`\n* **List items**: The values used to determine whether the exception prevents an alert from being generated.\n\nAll list items in the same list container must be of the same data type, and each item defines a single value. For example, an IP list container named `internal-ip-addresses-southport` contains five items, where each item defines one internal IP address:\n1. `192.168.1.1`\n2. `192.168.1.3`\n3. `192.168.1.18`\n4. `192.168.1.12`\n5. `192.168.1.7`\n\nTo use these IP addresses as values for defining rule exceptions, use the Security exceptions API to [create an exception list item](../operation/operation-createexceptionlistitem) that references the `internal-ip-addresses-southport` list.\n> info\n> Lists cannot be added directly to rules, nor do they define the operators used to determine when exceptions are applied (`is in list`, `is not in list`). Use an exception item to define the operator and associate it with an [exception container](../operation/operation-createexceptionlist). You can then add the exception container to a rule's `exceptions_list` object.\n\n## Lists requirements\n\nBefore you can start using lists, you must create the `.lists` and `.items` data streams for the relevant Kibana space. To do this, use the [Create list data streams](../operation/operation-createlistindex) endpoint. Once these data streams are created, your role needs privileges to manage rules. Refer to [Enable and access detections](https://www.elastic.co/guide/en/security/current/detections-permissions-section.html#enable-detections-ui) for a complete list of requirements.\n"
    x-displayName: Security lists
  - name: Security Osquery API
    description: 'Run live queries, manage packs and saved queries.'
    x-displayName: Security Osquery
  - name: Security Solution Initialization API
    description: "Use the initialization API to set up the assets Elastic Security needs to operate in a Kibana space.\n\nA single request can run one or more initialization flows. Each flow provisions a specific set of assets (for example, list indices, security data views, prebuilt detection rules, endpoint protection, AI prompts, or detection rule monitoring assets). The response reports a per-flow result so you can tell which flows completed and which returned an error.\n"
    x-displayName: Security solution initialization
  - name: Security Timeline API
    description: 'You can create Timelines and Timeline templates via the API, as well as import new Timelines from an ndjson file.'
    x-displayName: Security timeline
  - name: short url
    description: Manage Kibana short URLs.
    x-displayName: Short URLs
  - name: slo
    description: 'SLO APIs enable you to define, manage and track service-level objectives'
    x-displayName: Service level objectives
  - name: spaces
    description: Manage your Kibana spaces.
    externalDocs:
      description: Space overview
      url: https://www.elastic.co/docs/deploy-manage/manage-spaces
    x-displayName: Spaces
  - name: streams
    description: "Streams provide a unified data management layer for ingestion, routing, and processing. There are three stream types:\n* **Wired** streams are managed by Kibana. They route documents to child streams based on\n  field conditions and support custom field mappings and processing steps.\n\n* **Classic** streams map to existing Elasticsearch data streams. You can add processing\n  steps to classic streams without changing their underlying index template.\n\n* **Query** streams are virtual aggregations backed by an ES|QL expression. They aggregate\n  data from multiple streams into a single logical view without duplicating documents.\n"
    externalDocs:
      description: Streams documentation
      url: https://www.elastic.co/docs/solutions/observability/streams/streams
    x-displayName: Streams
  - name: synthetics
    description: Synthetics APIs enable you to check the status of your services and applications.
    externalDocs:
      description: Synthetic monitoring
      url: https://www.elastic.co/docs/solutions/observability/synthetics
    x-displayName: Synthetics
  - name: system
    description: "Get information about the system status, resource usage, features, and installed plugins.\n"
    x-displayName: System
  - name: Tags
  - name: task manager
    description: 'Task manager APIs enable you to check the health of the Kibana task manager, which is used by features such as alerting, actions, and reporting to run mission critical work as persistent background tasks.'
    externalDocs:
      description: Task manager
      url: https://www.elastic.co/docs/deploy-manage/distributed-architecture/kibana-tasks-management
    x-displayName: Task manager
  - name: upgrade
    description: "The Kibana Upgrade Assistant API helps you prepare for the next major Elasticsearch release.\n> warn\n> This is a Kibana REST API (not an Elasticsearch API) and requests must target your Kibana URL:\n> * Self-managed URL pattern: `https://localhost:5601`\n> * Elastic Cloud URL pattern: `https://your-deployment.kb.us-east-1.aws.elastic.cloud:9243`\n"
    x-displayName: Upgrade assistant
  - name: uptime
    description: Uptime APIs enable you to view and update uptime monitoring settings.
    externalDocs:
      description: Uptime monitoring
      url: https://www.elastic.co/docs/solutions/observability/uptime
    x-displayName: Uptime
  - name: user session
    description: "Enables you to invalidate user sessions for security and session management purposes.\n"
    x-displayName: User session management
  - name: Visualizations
    description: "Create, retrieve, update, and delete [Kibana visualizations](https://www.elastic.co/docs/explore-analyze/visualize/lens). Visualizations created through this API are saved to your [visualization library](https://www.elastic.co/docs/explore-analyze/visualize/visualize-library).\n\n## When to use this API\n\n- Use this API to create reusable charts saved to the visualization library. You can then embed them in dashboards by referencing their ID from the [Dashboards API](dashboards#tag/Dashboards/operation/create-dashboard).\n- Use the [Dashboards API](dashboards#tag/Dashboards/operation/create-dashboard) when you want to define a complete dashboard in one request, or when you need ES|QL-based visualizations.\n\n## Get started\n\nBefore you begin:\n\n- **Authentication**: Refer to [Authentication](https://www.elastic.co/docs/api/doc/kibana#authentication) in the Kibana API documentation.\n- **CSRF protection**: Write operations (`POST`, `PUT`, `DELETE`) require the `kbn-xsrf: true` header.\n- **Spaces**: If you use non-default [Kibana spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces), prepend `s/{space_id}/` to the path.\n\n### Try it now\n\nThe following example creates a line chart showing log entries over time. You can run it after installing the [Kibana sample logs dataset](https://www.elastic.co/docs/manage-data/ingest/sample-data):\n\n```bash\ncurl -X POST \"${KIBANA_URL}/api/visualizations\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\" \\\n  -H \"kbn-xsrf: true\" \\\n  -H \"Content-Type: application/json\" \\\n  -d '{\n    \"type\": \"xy\",\n    \"title\": \"Total log entries over time\",\n    \"layers\": [\n      {\n        \"type\": \"line\",\n        \"data_source\": {\n          \"type\": \"data_view_spec\",\n          \"index_pattern\": \"kibana_sample_data_logs\",\n          \"time_field\": \"timestamp\"\n        },\n        \"x\": {\n          \"operation\": \"date_histogram\",\n          \"field\": \"timestamp\"\n        },\n        \"y\": [\n          {\n            \"operation\": \"count\"\n          }\n        ]\n      }\n    ]\n  }'\n```\n\nAll curl examples in this reference use [Kibana sample datasets](https://www.elastic.co/docs/manage-data/ingest/sample-data) (`kibana_sample_data_logs`, `kibana_sample_data_ecommerce`, `kibana_sample_data_flights`). To use your own data, replace the `index_pattern` and field names.\n\n### How a visualization is structured\n\nEvery visualization requires at minimum:\n\n- **`type`**: the chart to render. Each chart type has its own required fields, so the full structure of the request body depends on which `type` you specify.\n- **`data_source`**: how data is fetched. You can reference an existing Kibana data view by ID (`\"type\": \"data_view_reference\"`), define a data view inline using an index pattern (`\"type\": \"data_view_spec\"`), or use an ES|QL query (`\"type\": \"esql\"`). Note that ES|QL is only supported via the [Dashboards API](dashboards#tag/Dashboards/operation/create-dashboard). For most chart types, `data_source` is a top-level field. For XY charts, it belongs inside each layer in `layers[]`.\n\nYou can also include `query` and `filters` to apply KQL or Lucene filters to all chart data. Both are optional and can be omitted.\n\nEverything else is chart-specific: `layers` for XY charts, `metrics` for metric charts, and so on. Refer to the request schema on the [Create a visualization](#operation/create-visualization) endpoint for the full shape of each type.\n\n### Chart types\n\nThe `type` field in the request body determines the chart type:\n\n| Type | Chart | Documentation |\n|------|-------|---------------|\n| `data_table` | Data table | [Table](https://www.elastic.co/docs/explore-analyze/visualize/charts/tables) |\n| `gauge` | Gauge (bullet, circular) | [Gauge](https://www.elastic.co/docs/explore-analyze/visualize/charts/gauge-charts) |\n| `heatmap` | Heat map | [Heat map](https://www.elastic.co/docs/explore-analyze/visualize/charts/heat-map-charts) |\n| `metric` | Single value metric | [Metric](https://www.elastic.co/docs/explore-analyze/visualize/charts/metric-charts) |\n| `mosaic` | Mosaic | [Mosaic](https://www.elastic.co/docs/explore-analyze/visualize/charts/mosaic-charts) |\n| `pie` | Pie or donut (use `donut_hole` to control the hole size) | [Pie](https://www.elastic.co/docs/explore-analyze/visualize/charts/pie-charts) |\n| `region_map` | Region map (choropleth) | [Region map](https://www.elastic.co/docs/explore-analyze/visualize/charts/region-map-charts) |\n| `tag_cloud` | Tag cloud | [Tag cloud](https://www.elastic.co/docs/explore-analyze/visualize/charts/tag-cloud-charts) |\n| `treemap` | Treemap | [Treemap](https://www.elastic.co/docs/explore-analyze/visualize/charts/treemap-charts) |\n| `waffle` | Waffle | [Waffle](https://www.elastic.co/docs/explore-analyze/visualize/charts/waffle-charts) |\n| `xy` | Bar, line, area (and stacked/percentage variants) | [Bar](https://www.elastic.co/docs/explore-analyze/visualize/charts/bar-charts), [Line](https://www.elastic.co/docs/explore-analyze/visualize/charts/line-charts), [Area](https://www.elastic.co/docs/explore-analyze/visualize/charts/area-charts) |\n"
    externalDocs:
      description: Visualizations documentation
      url: https://www.elastic.co/docs/explore-analyze/visualize/lens
    x-displayName: Visualizations
  - name: workflows
    description: "Workflows enable you to automate multi-step processes directly in Kibana. Define sequences of steps in YAML to transform data insights into automated actions and outcomes, without needing external automation tools.\n\nUse the workflows APIs to create, manage, and run workflows programmatically. You can also search, export, import, and monitor workflow executions.\n"
    externalDocs:
      description: Workflows documentation
      url: https://www.elastic.co/docs/explore-analyze/workflows
    x-displayName: Workflows
x-topics:
  - title: Kibana spaces
    content: "Spaces enable you to organize your dashboards and other saved objects into meaningful categories.\nYou can use the default space or create your own spaces.\n\nTo run APIs in non-default spaces, you must add `s/{space_id}/` to the path.\nFor example:\n\n```bash\ncurl -X GET \"http://${KIBANA_URL}/s/marketing/api/data_views\" \\\n  -H \"Authorization: ApiKey ${API_KEY}\"\n```\n\nIf you use the Kibana console to send API requests, it automatically adds the appropriate space identifier.\n\nTo learn more, check out [Spaces](https://www.elastic.co/docs/deploy-manage/manage-spaces).\n"